Palo Alto Networks

Palo Alto Networks Security Rules API

Security Rules

GitHub OpenAPI
Business capability
Cybersecurity Management BC-620

Operations 17

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /security-rules List security rules · List security rules #
Ask an LLM
“Which security rules are in my pre-rulebase for a folder?”
“Can I find a security rule by name in Strata Cloud Manager?”
Tell an agent
List {position} security rules in folder {folder}.
Find the {position} security rule named {name}.
POST /security-rules Create a Prisma Access security rule · Create a security rule #
Ask an LLM
“How do I add a security rule to the Prisma Access candidate configuration?”
“Does a new Prisma Access rule take effect immediately or only after a push?”
Tell an agent
Create a Prisma Access candidate-config security rule in the {position} rulebase.
Add a new Prisma Access policy rule to the {position} rules of the candidate configuration.
GET /security-rules/{id} Get a security rule · Get a security rule #
Ask an LLM
“What sources, destinations and actions does one security rule have?”
“Can I retrieve a single security rule by id?”
Tell an agent
Show security rule {id}.
Get the full definition of security rule {id}.
PUT /security-rules/{id} Update a Prisma Access security rule · Update a security rule #
Ask an LLM
“How do I edit a Prisma Access security rule in the candidate configuration?”
“Can I change an existing Prisma Access rule without pushing the config right away?”
Tell an agent
Update Prisma Access rule {id} in the candidate config.
Save my edits to Prisma Access candidate-config security rule {id}.
DELETE /security-rules/{id} Delete a security rule · Delete a security rule #
Ask an LLM
“How do I delete a security rule from the policy?”
“Can I remove an obsolete security rule by its id?”
Tell an agent destructive · confirm first
Delete security rule {id}.
Remove the obsolete security rule {id} from policy.
POST /security-rules/{id}:move Reorder a security rule in the rulebase · Move a security rule #
Ask an LLM
“How do I move a security rule to the top of the rulebase?”
“Can I place one security rule right before another rule?”
Tell an agent
Move security rule {id} to {destination} of the {rulebase} rulebase.
Move security rule {id} {destination} rule {destination_rule} in the {rulebase} rulebase.
GET /sse/config/v1/security-rules List security rules via the SSE config API · List security rules #
Ask an LLM
“Which security rules are in the pre or post rulebase of a folder through the SSE config v1 endpoint?”
“Can I look up an SSE security rule by name within a folder?”
Tell an agent
List the {position} SSE security rules in folder {folder}.
Find the SSE config security rule named {name} in folder {folder} at position {position}.
POST /sse/config/v1/security-rules Create a security rule via the SSE config API · Create a security rule #
Ask an LLM
“How do I add a security rule to a folder through the SSE config v1 API?”
“Can I choose whether a new SSE config rule lands in the pre or post rulebase?”
Tell an agent
Create an SSE config security rule in folder {folder} at position {position}.
Add a new SSE v1 security rule to the {position} rulebase of folder {folder}.
DELETE /sse/config/v1/security-rules/{id} Delete a security rule via the SSE config API · Delete a security rule #
Ask an LLM
“How do I remove a security rule using the SSE config v1 endpoint?”
“Is deleting an SSE config rule by ID permanent?”
Tell an agent destructive · confirm first
Delete SSE config security rule {id}.
Remove the SSE security rule {id} from its rulebase.
GET /sse/config/v1/security-rules/{id} Get a security rule via the SSE config API · Get a security rule #
Ask an LLM
“What does one SSE config security rule look like in full?”
“Can I fetch an SSE security rule by its ID?”
Tell an agent
Show SSE config security rule {id}.
Fetch the SSE rule {id} and list its source and destination.
PUT /sse/config/v1/security-rules/{id} Edit a security rule via the SSE config API · Edit a security rule #
Ask an LLM
“How do I modify an existing security rule through the SSE config v1 endpoint?”
“Can I edit an SSE config security rule in place by its ID?”
Tell an agent
Edit SSE config security rule {id}.
Apply my changes to SSE v1 security rule {id}.
POST /sse/config/v1/security-rules/{id}:move Reorder a security rule in the rulebase · Move a security rule #
Ask an LLM
“How do I move a security rule above or below another rule?”
“Can I move a rule to the top or bottom of the pre or post rulebase?”
Tell an agent
Move security rule {id} in folder {folder} to {destination} of the {rulebase} rulebase.
Place rule {id} {destination} rule {destination_rule} in the {rulebase} rulebase of folder {folder}.
GET /config/rulestacks/{rulestack}/security-rules List Cloud NGFW rulestack security rules · Palo Alto Networks List Security Rules #
Ask an LLM
“Which security rules are in a Cloud NGFW rulestack, in priority order?”
“Can I page through a large rulestack's rules with a next token?”
Tell an agent
List the security rules in Cloud NGFW rulestack {rulestack}.
Show the next page of rules in rulestack {rulestack} using token {nexttoken}.
POST /config/rulestacks/{rulestack}/security-rules Add a security rule to a Cloud NGFW rulestack · Palo Alto Networks Create Security Rule #
Ask an LLM
“How do I add a new rule to a Cloud NGFW rulestack at a given priority?”
“Do lower priority numbers get evaluated first in a Cloud NGFW rulestack?”
Tell an agent
Add rule {RuleEntry} to Cloud NGFW rulestack {rulestack} at priority {Priority}.
Insert a new rulestack rule at priority {Priority} in {rulestack} defined as {RuleEntry}.
GET /config/rulestacks/{rulestack}/security-rules/{priority} Get a Cloud NGFW rule by priority · Palo Alto Networks Get Security Rule #
Ask an LLM
“What rule sits at a particular priority in my Cloud NGFW rulestack?”
“Can I see the candidate version of a rulestack rule instead of the running one?”
Tell an agent
Show the rule at priority {priority} in Cloud NGFW rulestack {rulestack}.
Fetch the candidate rule at priority {priority} of rulestack {rulestack}.
PUT /config/rulestacks/{rulestack}/security-rules/{priority} Update a Cloud NGFW rulestack rule · Palo Alto Networks Update Security Rule #
Ask an LLM
“How do I change the rule at a given priority in a Cloud NGFW rulestack?”
“Can I edit a rulestack rule's source, destination or action in place?”
Tell an agent
Replace the rule at priority {priority} in Cloud NGFW rulestack {rulestack} with {RuleEntry}.
Update rulestack {rulestack} rule {priority} to priority {Priority} using entry {RuleEntry}.
DELETE /config/rulestacks/{rulestack}/security-rules/{priority} Delete a Cloud NGFW rulestack rule · Palo Alto Networks Delete Security Rule #
Ask an LLM
“How do I remove a rule from a Cloud NGFW rulestack?”
“Does deleting the rule at one priority remove it from the rulestack entirely?”
Tell an agent destructive · confirm first
Delete the rule at priority {priority} from Cloud NGFW rulestack {rulestack}.
Remove rulestack {rulestack}'s priority {priority} rule.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-security-rules-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-security-rules-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-security-rules-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  version: 2.0.0
  title: Security Services Security Rules API
  description: These APIs are used for defining and managing security services configurations within Strata Cloud Manager.
  termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  contact:
    email: support@paloaltonetworks.com
    name: Palo Alto Networks Technical Support
    url: https://support.paloaltonetworks.com
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/config/security/v1
  description: Current
- url: https://api.sase.paloaltonetworks.com/sse/config/v1
  description: Legacy
security:
- scmToken: []
tags:


# --- truncated at 32 KB (100 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-security-rules-api-openapi.yml