Palo Alto Networks SaaS Instance API
The SaaS Instance API from Palo Alto Networks — 7 operation(s) for saas instance.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-saas-instance-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks SaaS Instance API
version: '1.0'
description: 'Operations tagged SaaS Instance across 3 of this provider''s published API definitions: palo-alto-identity-security-posture-management-api-openapi-original.yml, palo-alto-networks-saas-instance-api-openapi.yml, palo-alto-sase-identity-sspm-latest-identity-sspm-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
tags:
- name: SaaS Instance
paths:
/sspm/identity/v1/saas_instances:
get:
summary: Palo Alto Networks Get SaaS Instance List
description: "Retrieve a list of software as a service (SaaS) instances configured for the tenant. \nEach instance includes metadata such as application type and display name."
operationId: saas_instances_get
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ListResponseSaaSInstanceInfo'
examples:
SaasInstancesGet200Example:
summary: Default saas_instances_get 200 response
x-microcks-default: true
value:
total: 345
items:
- displayName: Production Agent 13
saasInstanceId: '806450'
appType: custom
'404':
description: Not Found
parameters:
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- SaaS Instance
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
/sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts:
get:
summary: Palo Alto Networks Get SaaS Account List
description: "Retrieve a list of user accounts associated with the specified software as a service (SaaS) instance. \nThe response includes account metadata such as roles, login activity, and status for each user."
operationId: saas_instances_saas_accounts_get
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ListResponseSaaSAccount'
examples:
SaasInstancesSaasAccountsGet200Example:
summary: Default saas_instances_saas_accounts_get 200 response
x-microcks-default: true
value:
total: 36
items:
- id: example-id
saasProviderId: '593378'
tenant: example-tenant
saasInstanceId: '357865'
jobId: '954046'
appId: '116192'
appType: standard
accountType: custom
accountName: Primary Sensor 93
email: jsmith@example.com
isLocal: true
isOrphaned: false
isElevated: true
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
roles: example-roles
creator: example-creator
linkedHumanAccounts: example-linkedHumanAccounts
saasProviderNhiName: Staging Policy 58
lastModifiedTime: &id001 2022-03-10 16:15:50+00:00
lastLoginTime: *id001
isNonHuman: false
createdTime: *id001
latestScanTime: *id001
lastCredentialsRotated: *id001
rotatedBy: example-rotatedBy
githubOrgName: Corporate Sensor 58
credentialsExpiresAt: *id001
- id: example-id
saasProviderId: '168374'
tenant: example-tenant
saasInstanceId: '608799'
jobId: '926117'
appId: '762667'
appType: standard
accountType: advanced
accountName: Staging Agent 78
email: jane.doe@example.com
isLocal: true
isOrphaned: false
isElevated: false
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
roles: example-roles
creator: example-creator
linkedHumanAccounts: example-linkedHumanAccounts
saasProviderNhiName: Branch Sensor 45
lastModifiedTime: *id001
lastLoginTime: *id001
isNonHuman: true
createdTime: *id001
latestScanTime: *id001
lastCredentialsRotated: *id001
rotatedBy: example-rotatedBy
githubOrgName: Corporate Gateway 50
credentialsExpiresAt: *id001
'404':
description: Not Found
parameters:
- name: saasInstanceId
in: path
required: true
schema:
type: string
example: '487550'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: limit
in: query
schema:
format: int32
type: integer
example: 90
- name: page
in: query
schema:
format: int32
type: integer
example: 772
- name: sortBy
in: query
schema:
type: string
example: example-sortBy
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- SaaS Instance
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
/sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/count:
get:
summary: Palo Alto Networks Get SaaS Account Count
description: "Return the number of user accounts associated with the specified software as a service (SaaS) instance. \nYou can apply filters to refine the account count based on criteria such as roles, status, or account types."
operationId: saas_instances_saas_accounts_count_get
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
additionalProperties:
format: int64
type: integer
examples:
SaasInstancesSaasAccountsCountGet200Example:
summary: Default saas_instances_saas_accounts_count_get 200 response
x-microcks-default: true
value: {}
'404':
description: Not Found
parameters:
- name: saasInstanceId
in: path
required: true
schema:
type: string
example: '116090'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- SaaS Instance
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
/sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/csv_report:
post:
summary: Palo Alto Networks Generate SaaS Account CSV Report
description: "Generate a CSV report of accounts linked to the specified software as a service (SaaS) instance. \nThis report helps in auditing user presence and roles within the application."
operationId: saas_instances_saas_accounts_count_csv_report_post
responses:
'201':
description: Created
'400':
description: Bad Request
parameters:
- name: saasInstanceId
in: path
required: true
schema:
type: string
example: '677018'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: sortBy
in: query
schema:
type: string
example: example-sortBy
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- SaaS Instance
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DownloadCsvRequest'
examples:
SaasInstancesSaasAccountsCountCsvReportPostRequestExample:
summary: Default saas_instances_saas_accounts_count_csv_report_post request
x-microcks-default: true
value:
userFullName: soc-analyst
userEmail: example-userEmail
service: example-service
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
/sspm/identity/v1/saas_instances/{saasInstanceId}/saas_activity:
get:
summary: Palo Alto Networks Get SaaS Activity Logs
description: "Retrieve a list of activity logs for the specified software as a service (SaaS) instance. \nLogs include user actions, accessed resources, locations, and timestamps to support security auditing and monitoring."
operationId: saas_instances_saas_activity_get
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ListResponseSaaSActivity'
examples:
SaasInstancesSaasActivityGet200Example:
summary: Default saas_instances_saas_activity_get 200 response
x-microcks-default: true
value:
total: 758
items:
- id: example-id
userId: '561798'
tenant: example-tenant
saasInstanceId: '246211'
appType: custom
resourceType: advanced
resourceName: Staging Agent 22
activityType: standard
clientIP: example-clientIP
location: example-location
userAgent: example-userAgent
summary: Configured policy configured configured violation suspicious malware.
rawData: example-rawData
activityDateTime: &id002 2022-03-10 16:15:50+00:00
createdAt: *id002
- id: example-id
userId: '362728'
tenant: example-tenant
saasInstanceId: '778286'
appType: custom
resourceType: advanced
resourceName: Primary Gateway 93
activityType: advanced
clientIP: example-clientIP
location: example-location
userAgent: example-userAgent
summary: Network incident threat rule investigation endpoint.
rawData: example-rawData
activityDateTime: *id002
createdAt: *id002
'404':
description: Not Found
parameters:
- name: saasInstanceId
in: path
required: true
schema:
type: string
example: '925818'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: limit
in: query
schema:
format: int32
type: integer
example: 992
- name: page
in: query
schema:
format: int32
type: integer
example: 998
- name: sortBy
in: query
schema:
type: string
example: example-sortBy
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- SaaS Instance
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
/sspm/identity/v1/{saasInstanceId}/tickets:
get:
summary: Palo Alto Networks Get SaaS Instance Tickets
description: Retrieve a list of tickets associated with the specified software as a service (SaaS) instance. Tickets track security findings, misconfigurations, or other remediation needs.
operationId: saas_instances_tickets_get
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ListResponseTicket'
examples:
SaasInstancesTicketsGet200Example:
summary: Default saas_instances_tickets_get 200 response
x-microcks-default: true
value:
total: 998
items:
- id: example-id
tenant: example-tenant
saasInstanceId: '788637'
resourceIds: example-resourceIds
feature: example-feature
users: example-users
integrationId: '917387'
type: custom
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
summary: Configured applied suspicious violation malware traffic endpoint on.
createdAt: &id003 2022-03-10 16:15:50+00:00
- id: example-id
tenant: example-tenant
saasInstanceId: '430821'
resourceIds: example-resourceIds
feature: example-feature
users: example-users
integrationId: '571142'
type: advanced
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
summary: Applied rule investigation applied firewall incident network network Security blocked.
createdAt: *id003
'404':
description: Not Found
parameters:
- name: saasInstanceId
in: path
required: true
schema:
type: string
example: '601090'
- name: filter
in: query
schema:
type: string
example: example-filter
- name: limit
in: query
schema:
format: int32
type: integer
example: 921
- name: page
in: query
schema:
format: int32
type: integer
example: 549
- name: sortBy
in: query
schema:
type: string
example: example-sortBy
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- SaaS Instance
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
post:
summary: Palo Alto Networks Create SaaS Instance Ticket
description: "Create a new ticket for the specified software as a service (SaaS) instance. \nTickets help track remediation efforts for flagged issues or vulnerabilities."
operationId: saas_instances_tickets_post
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/Ticket'
examples:
SaasInstancesTicketsPost200Example:
summary: Default saas_instances_tickets_post 200 response
x-microcks-default: true
value:
id: example-id
tenant: example-tenant
saasInstanceId: '155449'
resourceIds: example-resourceIds
feature: example-feature
users: example-users
integrationId: '300696'
type: advanced
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
summary: Suspicious detected traffic alert investigation endpoint firewall traffic monitoring.
createdAt: 2022-03-10 16:15:50+00:00
'400':
description: Bad Request
parameters:
- name: saasInstanceId
in: path
required: true
schema:
type: string
example: '685163'
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- SaaS Instance
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CreateTicketRequest'
examples:
SaasInstancesTicketsPostRequestExample:
summary: Default saas_instances_tickets_post request
x-microcks-default: true
value:
resourceIds:
- example-resourceIds_item
- example-resourceIds_item
feature: ACTIVITY
integrationId: '834310'
type: advanced
issueTypeId: '702842'
summary: Threat Security malware network rule threat on network threat policy.
description: Configured incident applied traffic endpoint monitoring rule.
settings: {}
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
delete:
summary: Palo Alto Networks Delete SaaS Instance Tickets
description: "Delete or unlink one or more tickets associated with the specified software as a service (SaaS) instance. \nThis action is typically used to close resolved or invalid issues."
operationId: saas_instances_tickets_delete
responses:
'204':
description: No Content
'404':
description: Not Found
parameters:
- name: saasInstanceId
in: path
required: true
schema:
type: string
example: '869627'
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- SaaS Instance
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UnlinkTicketRequest'
examples:
SaasInstancesTicketsDeleteRequestExample:
summary: Default saas_instances_tickets_delete request
x-microcks-default: true
value:
id: example-id
resourceIds:
- example-resourceIds_item
feature: ACTIVITY
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
/sspm/identity/v1/{saasInstanceId}/tickets/{ticketKey}/issues:
get:
summary: Palo Alto Networks Get Ticket Issues
description: "Retrieve a list of issues linked to a specific ticket for the given software as a service (SaaS) instance. \nThis helps in tracking and managing remediation or investigation items."
operationId: saas_instances_tickets_issues_get
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/ListResponseMapStringObject'
examples:
SaasInstancesTicketsIssuesGet200Example:
summary: Default saas_instances_tickets_issues_get 200 response
x-microcks-default: true
value:
total: 300
items:
- {}
- {}
'404':
description: Not Found
parameters:
- name: saasInstanceId
in: path
required: true
schema:
type: string
example: '290291'
- name: ticketKey
in: path
required: true
schema:
type: string
example: example-ticketKey
- name: limit
in: query
schema:
format: int32
type: integer
example: 581
- name: page
in: query
schema:
format: int32
type: integer
example: 147
- name: x-ps-tenant
in: header
schema:
type: string
example: example-x-ps-tenant
tags:
- SaaS Instance
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
components:
schemas:
ListResponseSaaSInstanceInfo:
type: object
properties:
total:
format: int64
type: integer
example: 345
items:
type: array
items:
$ref: '#/components/schemas/SaaSInstanceInfo'
example:
- displayName: Production Agent 13
saasInstanceId: '806450'
appType: custom
SaaSInstanceInfo:
type: object
properties:
displayName:
type: string
example: Staging Policy 12
saasInstanceId:
type: string
example: '949811'
appType:
type: string
example: advanced
ListResponseSaaSAccount:
type: object
properties:
total:
format: int64
type: integer
example: 36
items:
type: array
items:
$ref: '#/components/schemas/SaaSAccount'
example:
- id: example-id
saasProviderId: '593378'
tenant: example-tenant
saasInstanceId: '357865'
jobId: '954046'
appId: '116192'
appType: standard
accountType: custom
accountName: Primary Sensor 93
email: jsmith@example.com
isLocal: true
isOrphaned: false
isElevated: true
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
roles: example-roles
creator: example-creator
linkedHumanAccounts: example-linkedHumanAccounts
saasProviderNhiName: Staging Policy 58
lastModifiedTime: &id004 2022-03-10 16:15:50+00:00
lastLoginTime: *id004
isNonHuman: false
createdTime: *id004
latestScanTime: *id004
lastCredentialsRotated: *id004
rotatedBy: example-rotatedBy
githubOrgName: Corporate Sensor 58
credentialsExpiresAt: *id004
- id: example-id
saasProviderId: '168374'
tenant: example-tenant
saasInstanceId: '608799'
jobId: '926117'
appId: '762667'
appType: standard
accountType: advanced
accountName: Staging Agent 78
email: jane.doe@example.com
isLocal: true
isOrphaned: false
isElevated: false
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
roles: example-roles
creator: example-creator
linkedHumanAccounts: example-linkedHumanAccounts
saasProviderNhiName: Branch Sensor 45
lastModifiedTime: *id004
lastLoginTime: *id004
isNonHuman: true
createdTime: *id004
latestScanTime: *id004
lastCredentialsRotated: *id004
rotatedBy: example-rotatedBy
githubOrgName: Corporate Gateway 50
credentialsExpiresAt: *id004
SaaSAccount:
type: object
properties:
id:
type: string
example: example-id
saasProviderId:
type: string
example: '703346'
tenant:
type: string
example: example-tenant
saasInstanceId:
type: string
example: '765566'
jobId:
type: string
example: '560015'
appId:
type: string
example: '648367'
appType:
type: string
example: custom
accountType:
type: string
example: advanced
accountName:
type: string
example: Branch Policy 58
email:
type: string
example: analyst1@example.com
isLocal:
type: boolean
example: false
isOrphaned:
type: boolean
example: true
isElevated:
type: boolean
example: true
ticketKey:
type: string
example: example-ticketKey
ticketUrl:
type: string
example: example-ticketUrl
roles:
type: string
example: example-roles
creator:
type: string
example: example-creator
linkedHumanAccounts:
type: string
example: example-linkedHumanAccounts
saasProviderNhiName:
type: string
example: Production Agent 14
lastModifiedTime:
$ref: '#/components/schemas/Instant'
lastLoginTime:
$ref: '#/components/schemas/Instant'
isNonHuman:
type: boolean
example: false
createdTime:
$ref: '#/components/schemas/Instant'
latestScanTime:
$ref: '#/components/schemas/Instant'
lastCredentialsRotated:
$ref: '#/components/schemas/Instant'
rotatedBy:
type: string
example: example-rotatedBy
githubOrgName:
type: string
example: Staging Policy 17
credentialsExpiresAt:
$ref: '#/components/schemas/Instant'
UnlinkTicketRequest:
required:
- id
- feature
type: object
properties:
id:
type: string
example: example-id
resourceIds:
type: array
items:
type: string
example:
- example-resourceIds_item
feature:
$ref: '#/components/schemas/Feature'
CreateTicketRequest:
required:
- resourceIds
- feature
- integrationId
- type
- issueTypeId
- summary
type: object
properties:
resourceIds:
type: array
items:
type: string
example:
- example-resourceIds_item
- example-resourceIds_item
feature:
$ref: '#/components/schemas/Feature'
integrationId:
type: string
example: '834310'
type:
type: string
example: advanced
issueTypeId:
type: string
example: '702842'
summary:
type: string
example: Threat Security malware network rule threat on network threat policy.
description:
type: string
example: Configured incident applied traffic endpoint monitoring rule.
settings:
type: object
additionalProperties:
type: string
example: {}
DownloadCsvRequest:
required:
- userFullName
- userEmail
- service
type: object
properties:
userFullName:
type: string
example: soc-analyst
userEmail:
type: string
example: example-userEmail
service:
type: string
example: example-service
SaaSActivity:
type: object
properties:
id:
type: string
example: example-id
userId:
type: string
example: '558697'
tenant:
type: string
example: example-tenant
saasInstanceId:
type: string
example: '278773'
appType:
type: string
example: standard
resourceType:
type: string
example: custom
resourceName:
type: string
example: Staging Agent 77
activityType:
type: string
example: advanced
clientIP:
type: string
example: example-clientIP
location:
type: string
example: example-location
userAgent:
type: string
example: example-userAgent
summary:
type: string
example: Traffic network investigation policy applied activity incident incident monitoring suspicious incident.
rawData:
type: string
example: example-rawData
activityDateTime:
$ref: '#/components/schemas/Instant'
createdAt:
$ref: '#/components/schemas/Instant'
Feature:
enum:
- ENROLLMENT
- ACTIVITY
- LOGOUT
- IDENTITY_NHI
- IDENTITY_ACTIVITY
type: string
ListResponseMapStringObject:
type: object
properties:
total:
format: int64
type: integer
example: 300
items:
type: array
items:
type: object
example:
- {}
- {}
Ticket:
type: object
properties:
id:
type: string
example: example-id
tenant:
type: string
example: example-tenant
saasInstanceId:
type: string
example: '155449'
resourceIds:
type: string
example: example-resourceIds
feature:
type: string
example: example-feature
users:
type: string
example: example-users
integrationId:
type: string
example: '300696'
type:
type: string
example: advanced
ticketKey:
type: string
example: example-ticketKey
ticketUrl:
type: string
example: example-ticketUrl
summary:
type: string
example: Suspicious detected traffic alert investigation endpoint firewall traffic monitoring.
createdAt:
$ref: '#/components/schemas/Instant'
ListResponseTicket:
type: object
properties:
total:
format: int64
type: integer
example: 998
items:
type: array
items:
$ref: '#/components/schemas/Ticket'
example:
- id: example-id
tenant: example-tenant
saasInstanceId: '788637'
resourceIds: example-resourceIds
feature: example-feature
users: example-users
integrationId: '917387'
type: custom
ticketKey: example-ticketKey
ticketUrl: example-ticketUrl
summary: Configured applied suspicious violation malware traffic endpoint on.
createdAt: &id005 2022-03-10 16:15:50+00:00
- id: example-id
tenant: example-tenant
saasInstanceId: '430821'
resourceIds: example-resourceIds
feature: example-feature
users: example-users
integrationId
# --- truncated at 32 KB (39 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-saas-instance-api-openapi.yml