Rule stack management. Rule stacks contain the security policy applied to Cloud NGFW instances.
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-rulestacks-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Palo Alto Networks Cloud NGFW for AWS REST Rule Stacks API
description: REST API for managing Palo Alto Networks Cloud Next-Generation Firewall (Cloud NGFW) deployments on Amazon Web Services.
version: '1.0'
contact:
name: Palo Alto Networks Developer Support
url: https://pan.dev/cloudngfw/aws/
license:
name: Proprietary
url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.{region}.aws.cloudngfw.paloaltonetworks.com/v1
description: Cloud NGFW for AWS regional API endpoint.
variables:
region:
description: AWS region where Cloud NGFW is deployed (e.g., us-east-1, us-west-2, eu-west-1).
default: us-east-1
security:
- awsSigV4: []
tags:
- name: RuleStacks
description: Rule stack management. Rule stacks contain the security policy applied to Cloud NGFW instances.
paths:
/config/rulestacks:
get:
operationId: listRuleStacks
summary: Palo Alto Networks List Rule Stacks
description: Returns a paginated list of all rule stacks in the account. Rule stacks contain security rules, FQDN lists, prefix lists, and security profiles that define the firewall policy applied to Cloud NGFW instances.
tags:
- RuleStacks
parameters:
- name: maxresults
in: query
description: Maximum number of rule stacks to return per page.
schema:
type: integer
default: 100
maximum: 1000
example: 100
- name: nexttoken
in: query
description: Pagination token from a previous response.
schema:
type: string
example: example-nexttoken
- name: scope
in: query
description: Scope filter for rule stacks.
schema:
type: string
enum:
- Local
- Global
example: Global
responses:
'200':
description: Rule stacks returned successfully.
content:
application/json:
schema:
type: object
properties:
Response:
type: object
properties:
RuleStackCandidates:
type: array
items:
$ref: '#/components/schemas/RuleStackSummary'
NextToken:
type: string
description: Token for retrieving the next page of results.
ResponseStatus:
$ref: '#/components/schemas/ResponseStatus'
examples:
ListRuleStacks200Example:
summary: Default listRuleStacks 200 response
x-microcks-default: true
value:
Response:
RuleStackCandidates:
- RuleStackName: Corporate Sensor 39
Scope: Local
Status: ACTIVE
NextToken: example-NextToken
ResponseStatus:
ErrorCode: 0
Reason: ''
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'500':
$ref: '#/components/responses/InternalServerError'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
post:
operationId: createRuleStack
summary: Palo Alto Networks Create Rule Stack
description: Creates a new rule stack. A rule stack is a container for firewall policy including security rules, FQDN lists, and prefix lists. Rule stacks are associated with Cloud NGFW firewall instances to define their security policy.
tags:
- RuleStacks
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/RuleStackRequest'
examples:
CreateRuleStackRequestExample:
summary: Default createRuleStack request
x-microcks-default: true
value:
RuleStackName: Branch Policy 33
RuleStackEntry:
Description: Firewall endpoint applied malware violation network activity detected violation threat.
Scope: Local
MinAppIdVersion: 2.0.3
Profile:
AntiSpywareProfile: HVAC Controller
AntiVirusProfile: HVAC Controller
VulnerabilityProfile: HVAC Controller
URLFilteringProfile: HVAC Controller
responses:
'200':
description: Rule stack created successfully.
content:
application/json:
schema:
type: object
properties:
Response:
$ref: '#/components/schemas/RuleStack'
ResponseStatus:
$ref: '#/components/schemas/ResponseStatus'
examples:
CreateRuleStack200Example:
summary: Default createRuleStack 200 response
x-microcks-default: true
value:
Response:
RuleStackName: Primary Agent 48
RuleStackEntry:
Description: Detected monitoring blocked endpoint Security Security on detected.
Scope: Local
MinAppIdVersion: 7.5.1
LookupXForwardedFor: None
Profile:
AntiSpywareProfile: Network Printer
AntiVirusProfile: HVAC Controller
VulnerabilityProfile: HVAC Controller
URLFilteringProfile: Network Printer
FileBlockingProfile: Network Printer
UpdateToken: example-UpdateToken
ResponseStatus:
ErrorCode: 0
Reason: ''
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'409':
$ref: '#/components/responses/Conflict'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/config/rulestacks/{rulestack}:
get:
operationId: getRuleStack
summary: Palo Alto Networks Get Rule Stack
description: Returns the configuration of a specific rule stack by name.
tags:
- RuleStacks
parameters:
- $ref: '#/components/parameters/rulestack'
- name: candidate
in: query
description: Return candidate (uncommitted) configuration if true.
schema:
type: boolean
default: false
example: false
responses:
'200':
description: Rule stack returned successfully.
content:
application/json:
schema:
type: object
properties:
Response:
$ref: '#/components/schemas/RuleStack'
ResponseStatus:
$ref: '#/components/schemas/ResponseStatus'
examples:
GetRuleStack200Example:
summary: Default getRuleStack 200 response
x-microcks-default: true
value:
Response:
RuleStackName: Primary Agent 48
RuleStackEntry:
Description: Detected monitoring blocked endpoint Security Security on detected.
Scope: Local
MinAppIdVersion: 7.5.1
LookupXForwardedFor: None
Profile:
AntiSpywareProfile: Network Printer
AntiVirusProfile: HVAC Controller
VulnerabilityProfile: HVAC Controller
URLFilteringProfile: Network Printer
FileBlockingProfile: Network Printer
UpdateToken: example-UpdateToken
ResponseStatus:
ErrorCode: 0
Reason: ''
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
put:
operationId: updateRuleStack
summary: Palo Alto Networks Update Rule Stack
description: Updates the configuration of an existing rule stack. Changes are staged in candidate configuration until committed via the commit endpoint.
tags:
- RuleStacks
parameters:
- $ref: '#/components/parameters/rulestack'
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/RuleStackRequest'
examples:
UpdateRuleStackRequestExample:
summary: Default updateRuleStack request
x-microcks-default: true
value:
RuleStackName: Branch Policy 33
RuleStackEntry:
Description: Firewall endpoint applied malware violation network activity detected violation threat.
Scope: Local
MinAppIdVersion: 2.0.3
Profile:
AntiSpywareProfile: HVAC Controller
AntiVirusProfile: HVAC Controller
VulnerabilityProfile: HVAC Controller
URLFilteringProfile: HVAC Controller
responses:
'200':
description: Rule stack updated successfully.
content:
application/json:
schema:
type: object
properties:
Response:
$ref: '#/components/schemas/RuleStack'
ResponseStatus:
$ref: '#/components/schemas/ResponseStatus'
examples:
UpdateRuleStack200Example:
summary: Default updateRuleStack 200 response
x-microcks-default: true
value:
Response:
RuleStackName: Primary Agent 48
RuleStackEntry:
Description: Detected monitoring blocked endpoint Security Security on detected.
Scope: Local
MinAppIdVersion: 7.5.1
LookupXForwardedFor: None
Profile:
AntiSpywareProfile: Network Printer
AntiVirusProfile: HVAC Controller
VulnerabilityProfile: HVAC Controller
URLFilteringProfile: Network Printer
FileBlockingProfile: Network Printer
UpdateToken: example-UpdateToken
ResponseStatus:
ErrorCode: 0
Reason: ''
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
delete:
operationId: deleteRuleStack
summary: Palo Alto Networks Delete Rule Stack
description: Deletes a rule stack. The rule stack must not be associated with any active Cloud NGFW firewall instances before deletion.
tags:
- RuleStacks
parameters:
- $ref: '#/components/parameters/rulestack'
responses:
'200':
description: Rule stack deleted successfully.
content:
application/json:
schema:
type: object
properties:
ResponseStatus:
$ref: '#/components/schemas/ResponseStatus'
examples:
DeleteRuleStack200Example:
summary: Default deleteRuleStack 200 response
x-microcks-default: true
value:
ResponseStatus:
ErrorCode: 0
Reason: ''
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
'409':
$ref: '#/components/responses/Conflict'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
/config/rulestacks/{rulestack}/commit:
post:
operationId: commitRuleStack
summary: Palo Alto Networks Commit Rule Stack
description: Commits the candidate configuration of the rule stack to the running configuration. This applies all staged changes to active Cloud NGFW firewall instances associated with this rule stack.
tags:
- RuleStacks
parameters:
- $ref: '#/components/parameters/rulestack'
responses:
'200':
description: Rule stack commit initiated successfully.
content:
application/json:
schema:
type: object
properties:
Response:
type: object
properties:
CommitStatus:
type: string
enum:
- CommitSuccess
- CommitFailed
- CommitInProgress
JobId:
type: string
description: Job ID to poll for commit completion status.
ResponseStatus:
$ref: '#/components/schemas/ResponseStatus'
examples:
CommitRuleStack200Example:
summary: Default commitRuleStack 200 response
x-microcks-default: true
value:
Response:
CommitStatus: CommitFailed
JobId: '850717'
ResponseStatus:
ErrorCode: 0
Reason: ''
'400':
$ref: '#/components/responses/BadRequest'
'401':
$ref: '#/components/responses/Unauthorized'
'404':
$ref: '#/components/responses/NotFound'
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
components:
responses:
NotFound:
description: The requested resource was not found.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Unauthorized:
description: Missing or invalid AWS credentials.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
InternalServerError:
description: An internal server error occurred.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Forbidden:
description: Insufficient IAM permissions for the requested operation.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
Conflict:
description: A resource with the specified name already exists or cannot be modified.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
BadRequest:
description: Malformed request or invalid parameters.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
schemas:
RuleStack:
type: object
description: A rule stack containing security policy for Cloud NGFW firewall instances.
properties:
RuleStackName:
type: string
description: Unique name of the rule stack.
example: Primary Agent 48
RuleStackEntry:
type: object
properties:
Description:
type: string
example: Incident rule network detected investigation applied threat incident Security suspicious blocked activity.
Scope:
type: string
enum:
- Local
- Global
example: Local
MinAppIdVersion:
type: string
description: Minimum App-ID content version required.
example: 5.7.7
LookupXForwardedFor:
type: string
enum:
- SecurityPolicy
- None
example: SecurityPolicy
Profile:
type: object
properties:
AntiSpywareProfile:
type: string
example: IP Camera
AntiVirusProfile:
type: string
example: IP Camera
VulnerabilityProfile:
type: string
example: IP Camera
URLFilteringProfile:
type: string
example: Network Printer
FileBlockingProfile:
type: string
example: HVAC Controller
example:
AntiSpywareProfile: IP Camera
AntiVirusProfile: Network Printer
VulnerabilityProfile: HVAC Controller
URLFilteringProfile: HVAC Controller
FileBlockingProfile: HVAC Controller
example:
Description: Detected monitoring blocked endpoint Security Security on detected.
Scope: Local
MinAppIdVersion: 7.5.1
LookupXForwardedFor: None
Profile:
AntiSpywareProfile: Network Printer
AntiVirusProfile: HVAC Controller
VulnerabilityProfile: HVAC Controller
URLFilteringProfile: Network Printer
FileBlockingProfile: Network Printer
UpdateToken:
type: string
description: Optimistic lock token for concurrent modification detection.
example: example-UpdateToken
RuleStackSummary:
type: object
properties:
RuleStackName:
type: string
example: Corporate Sensor 39
Scope:
type: string
enum:
- Local
- Global
example: Local
Status:
type: string
enum:
- ACTIVE
- INACTIVE
- ERROR
example: ACTIVE
ResponseStatus:
type: object
description: Standard API response status envelope included in all responses.
properties:
ErrorCode:
type: integer
description: Error code. 0 indicates success.
example: 0
Reason:
type: string
description: Human-readable status message.
example: ''
RuleStackRequest:
type: object
required:
- RuleStackName
- RuleStackEntry
properties:
RuleStackName:
type: string
example: Branch Policy 33
RuleStackEntry:
type: object
properties:
Description:
type: string
example: Endpoint activity incident network monitoring investigation.
Scope:
type: string
enum:
- Local
- Global
default: Local
example: Local
MinAppIdVersion:
type: string
example: 8.8.3
Profile:
type: object
properties:
AntiSpywareProfile:
type: string
example: Network Printer
AntiVirusProfile:
type: string
example: IP Camera
VulnerabilityProfile:
type: string
example: IP Camera
URLFilteringProfile:
type: string
example: IP Camera
example:
AntiSpywareProfile: IP Camera
AntiVirusProfile: Network Printer
VulnerabilityProfile: IP Camera
URLFilteringProfile: Network Printer
example:
Description: Firewall endpoint applied malware violation network activity detected violation threat.
Scope: Local
MinAppIdVersion: 2.0.3
Profile:
AntiSpywareProfile: HVAC Controller
AntiVirusProfile: HVAC Controller
VulnerabilityProfile: HVAC Controller
URLFilteringProfile: HVAC Controller
ErrorResponse:
type: object
properties:
ResponseStatus:
type: object
properties:
ErrorCode:
type: integer
example: 869
Reason:
type: string
example: Blocked investigation activity firewall activity malware network on applied.
example:
ErrorCode: 719
Reason: Alert incident applied violation rule blocked alert violation incident suspicious suspicious.
parameters:
rulestack:
name: rulestack
in: path
required: true
description: Name of the rule stack.
schema:
type: string
securitySchemes:
awsSigV4:
type: apiKey
in: header
name: Authorization
description: AWS Signature Version 4 (SigV4) signed request. Use an AWS IAM role or user with CloudNGFW IAM permissions. Sign requests using the service name cloudngfw and the target AWS region. Include x-amz-date and x-amz-security-token headers as required.