Palo Alto Networks

Palo Alto Networks Permission Groups API

Permission groups enable you to restrict access to one or more features available on the Prisma Cloud administrative console. Permission group APIs allow you to retrieve, update or delete one or more existing permissions groups. You can also use these APIs to create a custom permission group and then you must attach it to a role and assign the role to a user.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 6

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /authz/v1/feature List features for custom permission groups · Get all active features #
Ask an LLM
“Which Prisma Cloud features can I grant in a custom permission group?”
“What active features are available to assign permissions on?”
Tell an agent
List all active features I can add to a custom permission group.
Show the Prisma Cloud features available for permissions.
GET /authz/v1/permission_group/{id} Get a permission group by ID · Get an existing Permission Group by ID #
Ask an LLM
“What features and permissions does a specific permission group grant?”
“Can I also see which roles use a permission group?”
Tell an agent
Get permission group {id}.
Show permission group {id} including its associated roles {includeAssociatedRoles}.
PUT /authz/v1/permission_group/{id} Update a permission group · Update an existing Permission Group #
Ask an LLM
“Can I add another feature to an existing permission group?”
“How do I rename a permission group?”
Tell an agent
Update permission group {id} with features {features}.
Rename permission group {id} to {name} keeping features {features}.
DELETE /authz/v1/permission_group/{id} Delete a permission group · Delete an existing Permission Group by ID #
Ask an LLM
“How do I delete a custom permission group?”
“Can default permission groups be deleted too?”
Tell an agent destructive · confirm first
Delete permission group {id}.
Remove the permission group with ID {id}.
GET /authz/v1/permission_group List all permission groups · Get all existing Permission Groups #
Ask an LLM
“What permission groups exist in my Prisma Cloud tenant?”
“Can the permission group list include each group's features and roles?”
Tell an agent
List all permission groups.
List permission groups with features included {includeFeatures}.
POST /authz/v1/permission_group Create a custom permission group · Add new Custom Permission Group #
Ask an LLM
“How do I create a custom permission group that limits console access?”
“Can a new permission group be restricted to just a few features?”
Tell an agent
Create custom permission group {name} with features {features}.
Add permission group {name} described as {description} granting {features}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-permission-groups-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-permission-groups-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-permission-groups-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Permission Groups API
  version: '1.0'
  description: 'Operations tagged Permission Groups across 2 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-permissiongroupsmicroservice-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: Permission groups enable you to restrict access to one or more features available on the Prisma Cloud administrative console. Permission group APIs allow you to retrieve, update or delete one or more existing permissions groups. You can also use these APIs to create a custom permission group and then you must attach it to a role and assign the role to a user.
  name: Permission Groups
paths:
  /authz/v1/feature:
    get:
      tags:
      - Permission Groups
      summary: Get all active features
      description: Returns a list of Prisma Cloud features that can be added to Custom Permission Groups
      operationId: getFeatures
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /authz/v1/permission_group/{id}:
    get:
      tags:
      - Permission Groups
      summary: Get an existing Permission Group by ID
      description: Queries a list of existing permission groups by ID and returns a specific permission group that matches the Permission Group ID.
      operationId: get_1
      parameters:
      - name: id
        in: path
        description: PermissionGroupID
        required: true
        schema:
          type: string
      - name: includeAssociatedRoles
        in: query
        description: To include associated roles in the response
        required: false
        schema:
          type: boolean
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGroupDetail'
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGroupDetail'
      security:
      - x-redlock-auth: []
    put:
      tags:
      - Permission Groups
      summary: Update an existing Permission Group
      description: Updates the parameters of an existing permission group.
      operationId: update_1
      parameters:
      - name: id
        in: path
        description: PermissionGroupId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionGroupRequest'
        required: true
      responses:
        '204':
          description: Successful operation
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
      security:
      - x-redlock-auth: []
    delete:
      tags:
      - Permission Groups
      summary: Delete an existing Permission Group by ID
      description: Deletes the default or custom permission group with the specified ID.
      operationId: delete
      parameters:
      - name: id
        in: path
        description: PermissionGroupID
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Successful operation
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /authz/v1/permission_group:
    get:
      tags:
      - Permission Groups
      summary: Get all existing Permission Groups
      description: Returns a list of all existing Permission Groups.
      operationId: getAll
      parameters:
      - name: includeAssociatedRoles
        in: query
        description: To include associated roles in the response
        required: false
        schema:
          type: boolean
      - name: includeFeatures
        in: query
        description: To include permitted features in the response
        required: false
        schema:
          type: boolean
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PermissionGroupDetail'
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PermissionGroupDetail'
      security:
      - x-redlock-auth: []
    post:
      tags:
      - Permission Groups
      summary: Add new Custom Permission Group
      description: Creates a new custom permission group with granular permissions that restrict access to the Prisma Cloud administrative console. Values include name, optional description and selection of enabled features and functions.
      operationId: save
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionGroupRequest'
        required: true
      responses:
        '201':
          description: Successful operation
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
components:
  schemas:
    PermissionGroupRequest:
      title: Model used for permission group
      required:
      - features
      - name
      type: object
      properties:
        name:
          type: string
          description: Permission Group Name
        description:
          type: string
          description: Permission Group Description
        features:
          type: array
          description: List of Prisma Cloud Features
          items:
            $ref: '#/components/schemas/Feature1'
    Feature1:
      required:
      - featureName
      - operations
      type: object
      properties:
        featureName:
          type: string
          description: 'Prisma Cloud Feature Name. Prisma Cloud feature names can be retreived from GET: /authz/v1/feature API Endpoint'
        operations:
          type: object
          additionalProperties:
            type: object
            description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
          description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
      description: "Collection of permitted features associated with the role. \n Refer to PermissionGroup API docs to get the entire list of PC features."
    PermissionGroupDetail:
      type: object
      properties:
        name:
          type: string
          description: Permission Group Name
        description:
          type: string
          description: Permission Group Description
        type:
          type: string
          description: Permission Group Type
          enum:
          - Default
          - Custom
          - Internal
          - Default
          - Custom
        lastModifiedBy:
          type: string
        lastModifiedTs:
          type: integer
          format: int64
        associatedRoles:
          type: object
          additionalProperties:
            type: object
            description: Map of associated role Ids and Names
          description: Map of associated role Ids and Names
        features:
          $ref: '#/components/schemas/Feature1'
        acceptAccountGroups:
          type: boolean
          description: acceptAccountGroups
        acceptResourceLists:
          type: boolean
          description: acceptResourceLists
        acceptCodeRepositories:
          type: boolean
          description: acceptCodeRepositories
        custom:
          type: boolean
          description: Boolean value signifying whether this is a custom (i.e. user-defined) permission group. Is set to true if the attribute value of permissionGroupType is set to CUSTOM
        id:
          type: string
          description: Permission Group ID
    PermissionGroupRequest_2:
      title: Model used for permission group
      required:
      - features
      - name
      type: object
      properties:
        name:
          type: string
          description: Permission Group Name
        description:
          type: string
          description: Permission Group Description
        features:
          type: array
          description: List of Prisma Cloud Features
          items:
            $ref: '#/components/schemas/Feature'
    PermissionGroupDetail_2:
      type: object
      properties:
        name:
          type: string
          description: Permission Group Name
        description:
          type: string
          description: Permission Group Description
        type:
          type: string
          description: Permission Group Type
          enum:
          - Default
          - Custom
        lastModifiedBy:
          type: string
        lastModifiedTs:
          type: integer
          format: int64
        associatedRoles:
          type: object
          additionalProperties:
            type: object
            description: Map of associated role Ids and Names
          description: Map of associated role Ids and Names
        features:
          $ref: '#/components/schemas/Feature'
        acceptAccountGroups:
          type: boolean
          description: acceptAccountGroups
        acceptResourceLists:
          type: boolean
          description: acceptResourceLists
        acceptCodeRepositories:
          type: boolean
          description: acceptCodeRepositories
        custom:
          type: boolean
          description: Boolean value signifying whether this is a custom (i.e. user-defined) permission group. Is set to true if the attribute value of permissionGroupType is set to CUSTOM
        id:
          type: string
          description: Permission Group ID
    Feature:
      required:
      - featureName
      - operations
      type: object
      properties:
        featureName:
          type: string
          description: 'Prisma Cloud Feature Name. Prisma Cloud feature names can be retreived from GET: /authz/v1/feature API Endpoint'
        operations:
          type: object
          additionalProperties:
            type: object
            description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
          description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
      description: List of Prisma Cloud Features
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
externalDocs:
  description: Platform Wiki Documentation
  url: https://redlock.atlassian.net/wiki/spaces/RED/pages/2744877602/Platform+AuthN+Integration+Template
x-refined-from:
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json
- palo-alto-cspm-permissiongroupsmicroservice-openapi.json