Palo Alto Networks Plugins (Connectors) API
APIs for Plugins (Connectors).
OpenAPI Specification
openapi: 3.2.0
info:
title: TLS Protect Cloud API for Strata Cloud Manager Plugins (Connectors) API
description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
version: 1.0.0
license:
name: MIT
url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Plugins (Connectors)
description: APIs for Plugins (Connectors).
paths:
/v1/plugins:
get:
description: Retrieve all the plugins for the tenant.
operationId: get-v1-plugins
parameters:
- description: Filter by provided plugin type.
in: query
name: pluginTypes
schema:
items:
$ref: '#/components/schemas/PluginType'
minItems: 1
type: array
uniqueItems: true
- description: Include disabled plugins if set to true.
in: query
name: includeDisabled
schema:
default: false
type: boolean
responses:
'200':
content:
application/json:
schema:
properties:
plugins:
items:
$ref: '#/components/schemas/Plugin'
type: array
required:
- plugins
type: object
description: Success. All plugins retrieved.
summary: Retrieve all plugins
tags:
- Plugins (Connectors)
post:
description: Create a custom plugin for your tenant's exclusive use. The user must be a SYSTEM_ADMIN or a PKI_ADMIN.
operationId: post-v1-plugins
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PublicPluginCreationRequest'
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/PluginResponse'
description: Success. Plugin created.
summary: Create a local plugin
tags:
- Plugins (Connectors)
/v1/plugins/{id}:
get:
description: Retrieve a plugin with the specified ID.
operationId: get-v1-plugins-id
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/Plugin'
description: Success. Plugin retrieved.
summary: Retrieve plugin by ID
tags:
- Plugins (Connectors)
parameters:
- description: Plugin ID
in: path
name: id
required: true
schema:
type: string
patch:
description: Update a plugin with specified ID. Plugin must be owned by the tenant and the user must be a SYSTEM_ADMIN or a PKI_ADMIN.
operationId: patch-v1-plugins-id
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PublicPluginUpdateRequest'
responses:
'200':
description: Success. Plugin updated.
'401':
description: Unauthorized
'403':
description: Forbidden
summary: Update a local plugin
tags:
- Plugins (Connectors)
parameters:
- description: Plugin ID
in: path
name: id
required: true
schema:
type: string
delete:
description: Delete a plugin with the specified ID. Plugin must be owned by the tenant and the user must be a SYSTEM_ADMIN or a PKI_ADMIN.
operationId: delete-v1-plugins-id
responses:
'204':
description: No Content.
summary: Delete a local plugin
tags:
- Plugins (Connectors)
parameters:
- description: Plugin ID
in: path
name: id
required: true
schema:
type: string
/v1/plugins/{id}/disablements:
post:
description: Set a plugin to be disabled for your tenant.
operationId: post-v1-plugins-id-exclusions
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/PluginResponse'
description: Successfully disabled the plugin for the current tenant.
summary: Disable a plugin
tags:
- Plugins (Connectors)
parameters:
- description: Plugin ID that is currently marked as disabled.
in: path
name: id
required: true
schema:
type: string
delete:
description: Remove a plugin exclusion from your tenant.
operationId: delete-v1-plugins-id-exclusions
responses:
'204':
description: No Content. Successfully deleted the plugin disablement.
summary: Remove plugin disablement
tags:
- Plugins (Connectors)
parameters:
- description: Plugin ID that is currently marked as disabled.
in: path
name: id
required: true
schema:
type: string
/v1/plugins/disablements:
get:
description: Retrieve all the disabled plugins for the current tenant.
operationId: get-v1-plugins-exclusions
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PluginResponse'
description: Successfully retrieved all the disabled plugins for the current tenant.
summary: Retrieve all disabled plugins
tags:
- Plugins (Connectors)
components:
schemas:
Deployment:
properties:
executionTarget:
default: vsat
description: HELP
type: string
image:
description: URL for where the plugin image resides.
type: string
required:
- image
- executionTarget
title: Deployment
type: object
x-examples:
Example 1:
deployment:
executionTarget: vsat
image: public.ecr.aws/docker/library/nginx:mainline-alpine3.18-slim
PluginResponse:
properties:
plugins:
items:
$ref: '#/components/schemas/Plugin'
type: array
required:
- plugins
title: PluginResponse
type: object
PublicPluginCreationRequest:
properties:
maintainer:
description: Refers to the organization, individual, email, location, or website responsible for maintaining the plugin.
type:
- string
- 'null'
manifest:
$ref: '#/components/schemas/Manifest'
pluginType:
$ref: '#/components/schemas/PluginType'
required:
- manifest
- pluginType
title: PublicPluginCreationRequest
type: object
x-stoplight:
id: sto5fs3n5bxmf
WorkType:
description: Defines the type of supported workflow for the plugin.
enum:
- DISCOVERY
- CREDENTIAL
- PROVISIONING
- ISSUANCE
- CERTIFICATE_IMPORT
title: WorkType
type: string
PluginType:
description: Used for differentiation between different types of plugins.
enum:
- MACHINE
- CA
- TPP
- CREDENTIAL_MANAGER
title: PluginType
type: string
PublicPluginUpdateRequest:
properties:
image:
type:
- string
- 'null'
maintainer:
type:
- string
- 'null'
manifest:
$ref: '#/components/schemas/Manifest'
title: PublicPluginUpdateRequest
type: object
x-stoplight:
id: 8ypau6to0udah
Plugin:
properties:
creationTime:
description: Represents the date when the plugin was created.
format: date-time
type: string
disabled:
description: Indicates whether the tenant has disabled the plugin from its list of plugins.
type: boolean
id:
description: Represents the plugin ID.
type: string
lastModifiedOn:
description: Date the plugin was last modified.
format: date-time
type: string
maintainer:
description: Refers to the organization, individual, email, location, or website responsible for maintaining the plugin.
type:
- string
- 'null'
manifest:
$ref: '#/components/schemas/Manifest'
name:
description: Represents the name of the plugin. This must be unique.
type: string
pluginType:
$ref: '#/components/schemas/PluginType'
revision:
description: Represents the number of times the plugins has been updated.
type: integer
workTypes:
description: Represents the type of workflow the plugin supports.
items:
$ref: '#/components/schemas/WorkType'
minItems: 1
type: array
required:
- id
- name
- revision
- pluginType
- workTypes
- manifest
- lastModifiedOn
- creationTime
title: Plugin
type: object
LocalizationResource:
description: Translation map for the UI being rendered. This map is used with the manifest schema. The keys represent the values provided for the "x-localizationKey" property in the domain entity definition, and each key's value is used to represent field labels, enum values, or error messages.
properties:
en:
type: object
title: LocalizationResources
type:
- object
- 'null'
x-examples:
Example 1:
en:
address:
label: Server Hostname
binding:
label: Server Store Details
certificateName:
description: How the certificate should appear on the server.
label: Certificate Name
chainName:
label: Chain Bundle Name
discovery:
expiredCertificatesLabel: Exclude expired certificates
inactiveProfilesLabel: Exclude certificates that are not in use by either a virtual server or a monitor.
partitionDescription: A comma separated list of partition names.
partitionLabel: Partition(s)
discoveryType:
all: Both Monitors and Virtual Servers
label: Resource Types to Discover
monitor: Monitors
virtualServer: Virtual Servers
keystore:
label: Certificate Information
parentProfile:
description: No value is interpreted as "clientssl" or "serverssl" depending on the Profile Type selected.
label: Parent Profile
partition:
description: No value is interpreted as the "Common" partition.
label: Partition
password:
hidePassword: Hide Password
label: Password
showPassword: Show Password
port:
description: No value is interpreted as 443.
label: Port
serverName:
description: An alternative DNS name used for Server Name Indication.
label: SNI
sslProfile:
label: SSL Profile
sslProfileType:
client: Client SSL Profile
label: Profile Type
server: Server SSL Profile
username:
label: Username
Manifest:
properties:
deployment:
$ref: '#/components/schemas/Deployment'
description:
description: Description text for the plugin.
type: string
domainSchema:
type: object
hooks:
properties:
mapping:
type: object
requestConverters:
items: {}
type:
- array
- 'null'
required:
- mapping
type: object
localizationResources:
$ref: '#/components/schemas/LocalizationResource'
name:
description: Name of the plugin.
type: string
pluginType:
$ref: '#/components/schemas/PluginType'
workTypes:
description: Defines the type of workflows supported for the plugin.
items:
$ref: '#/components/schemas/WorkType'
minItems: 1
type: array
uniqueItems: true
required:
- name
- workTypes
- deployment
- domainSchema
- hooks
title: Manifest
type: object
x-examples:
Example 1:
deployment:
executionTarget: vsat
image: public.ecr.aws/docker/library/nginx:mainline-alpine3.18-slim
description: Description text.
domainSchema:
binding:
properties:
parentProfile:
description: parentProfile.description
type: string
x-labelLocalizationKey: parentProfile.label
x-rank: 1
serverName:
description: serverName.description
format: hostname
type: string
x-labelLocalizationKey: serverName.label
x-rank: 3
x-rule:
condition:
type: '#/properties/sslProfileType'
effect: SHOW
sslProfile:
type: string
x-labelLocalizationKey: sslProfile.label
x-rank: 2
sslProfileType:
oneOf:
- const: client
x-labelLocalizationKey: sslProfileType.client
- const: server
x-labelLocalizationKey: sslProfileType.server
x-labelLocalizationKey: sslProfileType.label
x-rank: 0
required:
- sslProfile
- sslProfileType
type: object
x-labelLocalizationKey: binding.label
x-primaryKey:
- '#/sslProfileType'
- '#/sslProfile'
certificateBundle:
properties:
certificate:
contentEncoding: base64
type: string
certificateChain:
contentEncoding: base64
type: string
privateKey:
contentEncoding: base64
type: string
x-encrypted-base64: true
required:
- certificate
- privateKey
- certificateChain
type: object
connection:
properties:
hostnameOrAddress:
type: string
x-labelLocalizationKey: address.label
x-rank: 0
password:
type: string
x-controlOptions:
hidePasswordLabel: password.hidePassword
password: true
showPasswordLabel: password.showPassword
x-encrypted: true
x-labelLocalizationKey: password.label
x-rank: 3
port:
description: port.description
maximum: 65535
minimum: 1
type: integer
x-labelLocalizationKey: port.label
x-rank: 1
username:
type: string
x-encrypted: true
x-labelLocalizationKey: username.label
x-rank: 2
required:
- hostnameOrAddress
- username
- password
type: object
discovery:
properties:
discoveryType:
oneOf:
- const: all
x-labelLocalizationKey: discoveryType.all
- const: monitor
x-labelLocalizationKey: discoveryType.monitor
- const: virtualServer
x-labelLocalizationKey: discoveryType.virtualServer
x-labelLocalizationKey: discoveryType.label
x-rank: 0
excludeExpiredCertificates:
type: boolean
x-labelLocalizationKey: discovery.expiredCertificatesLabel
x-rank: 2
excludeInactiveProfiles:
type: boolean
x-labelLocalizationKey: discovery.inactiveProfilesLabel
x-rank: 3
partition:
default: Common
description: discovery.partitionDescription
maxLength: 64
type: string
x-labelLocalizationKey: discovery.partitionLabel
x-rank: 1
type: object
discoveryControl:
properties:
maxResults:
type: int
required:
- maxResults
type: object
discoveryPage:
properties:
discoveryType:
type: string
paginator:
type: string
type: object
keystore:
properties:
certificateName:
description: certificateName.description
type: string
x-labelLocalizationKey: certificateName.label
x-rank: 0
chainName:
type: string
x-labelLocalizationKey: chainName.label
x-rank: 1
partition:
description: partition.description
maxLength: 64
type: string
x-labelLocalizationKey: partition.label
x-rank: 2
x-targetConfigurationRef: /partitions
required:
- certificateName
- chainName
type: object
x-labelLocalizationKey: keystore.label
x-primaryKey:
- '#/certificateName'
- '#/partition'
hooks:
mapping:
configureInstallationEndpoint: /v1/configureinstallationendpoint
discoverCertificates: /v1/discovercertificates
installCertificateBundle: /v1/installcertificatebundle
testConnection: /v1/testconnection
requestConverters:
- arguments-decrypter
localizationResources:
en:
address:
label: Server Hostname
binding:
label: Server Store Details
certificateName:
description: How the certificate should appear on the server.
label: Certificate Name
chainName:
label: Chain Bundle Name
discovery:
expiredCertificatesLabel: Exclude expired certificates.
inactiveProfilesLabel: Exclude certificates that are not in use by either a virtual server or a monitor.
partitionDescription: A comma separated list of partition names.
partitionLabel: Partition(s)
discoveryType:
all: Both Monitors and Virtual Servers
label: Resource Types to Discover
monitor: Monitors
virtualServer: Virtual Servers
keystore:
label: Certificate Information
parentProfile:
description: No value is interpreted as "clientssl" or "serverssl" depending on the Profile Type selected.
label: Parent Profile
partition:
description: No value is interpreted as the "Common" partition.
label: Partition
password:
hidePassword: Hide Password
label: Password
showPassword: Show Password
port:
description: No value is interpreted as 443.
label: Port
serverName:
description: An alternative DNS name used for Server Name Indication.
label: SNI
sslProfile:
label: SSL Profile
sslProfileType:
client: Client SSL Profile
label: Profile Type
server: Server SSL Profile
username:
label: Username
name: Sample Manifest
securitySchemes:
scmOAuth:
type: oauth2
description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
flows:
clientCredentials:
tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
scopes: {}
scmToken:
type: http
description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
scheme: bearer
bearerFormat: JWT