Palo Alto Networks

Palo Alto Networks SaaS Instance API

The SaaS Instance API from Palo Alto Networks — 7 operation(s) for saas instance.

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 9

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /sspm/identity/v1/saas_instances List connected SaaS instances · Palo Alto Networks Get SaaS Instance List #
Ask an LLM
“Which SaaS applications are connected to my SSPM tenant?”
“What app type and display name does each SaaS instance have?”
Tell an agent
List the SaaS instances configured for my tenant.
Show all SaaS instances for tenant {tenant}.
GET /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts List user accounts in a SaaS instance · Palo Alto Networks Get SaaS Account List #
Ask an LLM
“Who has an account in one of my connected SaaS apps, and what roles do they hold?”
“Can I sort and page through SaaS user accounts with a filter?”
Tell an agent
List the user accounts in SaaS instance {saasInstanceId}.
Show accounts in {saasInstanceId} matching {filter}, sorted by {sortBy}.
GET /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/count Count user accounts in a SaaS instance · Palo Alto Networks Get SaaS Account Count #
Ask an LLM
“How many user accounts exist in a given SaaS app?”
“Can I count only admin or inactive accounts in a SaaS instance?”
Tell an agent
Count the accounts in SaaS instance {saasInstanceId}.
Give me the number of accounts in {saasInstanceId} that match {filter}.
POST /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/csv_report Generate a CSV report of SaaS accounts · Palo Alto Networks Generate SaaS Account CSV Report #
Ask an LLM
“Can I get a CSV export of everyone who has access to a SaaS app for an audit?”
“How do I generate an account report for one SaaS instance?”
Tell an agent
Generate a CSV account report for SaaS instance {saasInstanceId} and send it to {userEmail}.
Build the {service} account CSV for {saasInstanceId}, requested by {userFullName} at {userEmail}.
GET /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_activity Get activity logs for a SaaS instance · Palo Alto Networks Get SaaS Activity Logs #
Ask an LLM
“What have users been doing inside a connected SaaS app, and from where?”
“Can I filter SaaS activity logs to audit specific actions?”
Tell an agent
Show the activity logs for SaaS instance {saasInstanceId}.
Pull {limit} activity log entries from {saasInstanceId} matching {filter}.
GET /sspm/identity/v1/{saasInstanceId}/tickets List remediation tickets for a SaaS instance · Palo Alto Networks Get SaaS Instance Tickets #
Ask an LLM
“Which remediation tickets are open for misconfigurations in a SaaS app?”
“Can I filter the tickets tracked against a SaaS instance?”
Tell an agent
List the tickets for SaaS instance {saasInstanceId}.
Show tickets on {saasInstanceId} matching {filter}.
POST /sspm/identity/v1/{saasInstanceId}/tickets Open a remediation ticket for a SaaS instance · Palo Alto Networks Create SaaS Instance Ticket #
Ask an LLM
“How do I open a ticket to track fixing a flagged SaaS misconfiguration?”
“Can a ticket cover several flagged resources at once?”
Tell an agent
Create a ticket on {saasInstanceId} titled {summary} for resources {resourceIds}.
Open a {type} ticket via integration {integrationId} for the {feature} finding in {saasInstanceId}.
DELETE /sspm/identity/v1/{saasInstanceId}/tickets Delete or unlink SaaS instance tickets · Palo Alto Networks Delete SaaS Instance Tickets #
Ask an LLM
“How do I unlink a resolved ticket from a SaaS instance?”
“Can I delete tickets that were opened by mistake?”
Tell an agent destructive · confirm first
Delete ticket {id} from SaaS instance {saasInstanceId}.
Unlink ticket {id} for the {feature} finding on {saasInstanceId}.
GET /sspm/identity/v1/{saasInstanceId}/tickets/{ticketKey}/issues List issues linked to a SaaS ticket · Palo Alto Networks Get Ticket Issues #
Ask an LLM
“Which individual issues are attached to a specific remediation ticket?”
“Can I page through the issues on one ticket?”
Tell an agent
List the issues linked to ticket {ticketKey} in {saasInstanceId}.
Show page {page} of issues on ticket {ticketKey} for SaaS instance {saasInstanceId}.

Specifications

⚙
OpenAPI
https://artifacts.apis.io/palo-alto-networks/openapi/palo-alto-networks-saas-instance-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-saas-instance-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-saas-instance-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Incident Security Service Posture Management SaaS Instance…
  version: '1.0'
  description: Endpoint to retrieve Identity Posture Security information This Open API spec file was created on July 01, 2025. © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
tags:


# --- truncated at 32 KB (33 KB total) ---
# Full source: https://artifacts.apis.io/palo-alto-networks/openapi/palo-alto-networks-saas-instance-api-openapi.yml