Palo Alto Networks Security Rules API
Security Rules
OpenAPI Specification
openapi: 3.2.0
info:
version: 2.0.0
title: Security Services Security Rules API
description: These APIs are used for defining and managing security services configurations within Strata Cloud Manager.
termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
contact:
email: support@paloaltonetworks.com
name: Palo Alto Networks Technical Support
url: https://support.paloaltonetworks.com
license:
name: MIT
url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/config/security/v1
description: Current
- url: https://api.sase.paloaltonetworks.com/sse/config/v1
description: Legacy
security:
- scmToken: []
tags:
- name: Security Rules
description: Security Rules
paths:
/security-rules:
get:
tags:
- Security Rules
summary: List security rules
description: 'Retrieve a list of security rules.
'
operationId: ListRules
parameters:
- $ref: '#/components/parameters/name'
- $ref: '#/components/parameters/position'
- $ref: '#/components/parameters/folder'
- $ref: '#/components/parameters/snippet'
- $ref: '#/components/parameters/device'
- $ref: '#/components/parameters/offset'
- $ref: '#/components/parameters/limit'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/SecurityRuleListResponse'
'400':
$ref: '#/components/responses/bad_request_errors_basic'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
default:
$ref: '#/components/responses/default_errors'
post:
tags:
- Security Rules
summary: Create a security rule
description: 'Create a new security rule.
'
operationId: CreateSecurityRules
parameters:
- $ref: '#/components/parameters/position'
requestBody:
description: Created
content:
application/json:
schema:
$ref: '#/components/schemas/security-rules'
responses:
'201':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/security-rules'
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors'
/security-rules/{id}:
get:
tags:
- Security Rules
summary: Get a security rule
description: 'Get an existing security rule.
'
operationId: GetSecurityRulesByID
parameters:
- $ref: '#/components/parameters/uuid'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/security-rules'
'400':
$ref: '#/components/responses/bad_request_errors_basic'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
default:
$ref: '#/components/responses/default_errors'
put:
tags:
- Security Rules
summary: Update a security rule
description: 'Update an existing security rule.
'
operationId: UpdateSecurityRulesByID
parameters:
- $ref: '#/components/parameters/uuid'
requestBody:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/security-rules'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/security-rules'
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors'
delete:
tags:
- Security Rules
summary: Delete a security rule
description: 'Delete a security rule.
'
operationId: DeleteSecurityRulesByID
parameters:
- $ref: '#/components/parameters/uuid'
responses:
'200':
$ref: '#/components/responses/http_ok'
'400':
$ref: '#/components/responses/bad_request_errors_basic'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors'
/security-rules/{id}:move:
post:
tags:
- Security Rules
summary: Move a security rule
description: 'Move an existing security rule.
'
operationId: MoveSecurityRulesByID
parameters:
- $ref: '#/components/parameters/uuid'
requestBody:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/rule-based-move'
responses:
'200':
$ref: '#/components/responses/http_ok'
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors'
components:
examples:
json_401_panui_auth_key_expired:
summary: Key Expired
value:
_errors:
- code: E016
message: Key Expired
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_501_panui_restapi_method_not_supported:
summary: Method Not Supported
value:
_errors:
- code: E012
message: Method Not Supported
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_input_format_mismatch:
summary: Input Format Mismatch
value:
_errors:
- code: E003
message: 'Input Format Mismatch: input-format=json'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_501_panui_restapi_version_not_supported:
summary: Version Not Supported
value:
_errors:
- code: E012
message: Version Not Supported
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_409_panui_mgmt_name_not_unique:
summary: Name Not Unique
value:
_errors:
- code: E006
message: Name Not Unique
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_409_panui_mgmt_object_not_unique:
summary: Object Not Unique
value:
_errors:
- code: E016
message: Object Not Unique
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_404_panui_mgmt_object_not_present:
summary: Object Not Present
value:
_errors:
- code: E005
message: Object Not Present
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_missing_body:
summary: Missing Body
value:
_errors:
- code: E003
message: Missing Body
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_409_panui_mgmt_reference_not_zero:
summary: Reference Not Zero
value:
_errors:
- code: E009
message: Reference Not Zero
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_output_format_mismatch:
summary: Output Format Mismatch
value:
_errors:
- code: E003
message: 'Output Format Mismatch: output-format=json Accept=xml'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_mgmt_invalid_command:
summary: Invalid Command
value:
_errors:
- code: E003
message: Invalid Command
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_401_panui_auth_not_authenticated:
summary: Not Authenticated
value:
_errors:
- code: E016
message: Not Authenticated
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_401_panui_auth_invalid_credential:
summary: Invalid Credential
value:
_errors:
- code: E016
message: Invalid Credential
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_403_panui_auth_unauthorized:
summary: Unauthorized
value:
_errors:
- code: E007
message: Unauthorized
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_missing_query_parameter:
summary: Missing Query Parameter
value:
_errors:
- code: E003
message: 'Missing Query Parameter: name'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_405_panui_restapi_action_not_supported:
summary: Action Not Supported
value:
_errors:
- code: E012
message: 'Action Not Supported: move'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_invalid_query_parameter:
summary: Invalid Query Parameter
value:
_errors:
- code: E003
message: 'Invalid Query Parameter: location=invalid'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_401_panui_auth_key_too_long:
summary: Key Too Long
value:
_errors:
- code: E016
message: Key Too Long
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_mgmt_invalid_object:
summary: Invalid Object
value:
_errors:
- code: E003
message: Invalid Object
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_mgmt_malformed_command:
summary: Malformed Command
value:
_errors:
- code: E003
message: Malformed Command
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_504_panui_mgmt_session_timeout:
summary: Session Timeout
value:
_errors:
- code: '4'
message: Session Timeout
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_401_panui_auth_need_password_change:
summary: Need Password Change
value:
_errors:
- code: E016
message: The password needs to be changed.
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_mgmt_bad_xpath:
summary: Bad XPath
value:
_errors:
- code: E013
message: Bad XPath
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
parameters:
uuid:
name: id
in: path
description: The UUID of the configuration resource
required: true
schema:
type: string
format: uuid
example: 123e4567-e89b-12d3-a456-426655440000
name:
name: name
in: query
description: The name of the configuration resource
required: false
schema:
type: string
limit:
name: limit
in: query
description: The maximum number of results per page
required: false
schema:
type: integer
default: 200
folder:
name: folder
in: query
description: 'The folder in which the resource is defined
'
required: false
schema:
type: string
snippet:
name: snippet
in: query
description: 'The snippet in which the resource is defined
'
required: false
schema:
type: string
offset:
name: offset
in: query
description: The offset into the list of results returned
required: false
schema:
type: integer
default: 0
device:
name: device
in: query
description: 'The device in which the resource is defined
'
required: false
schema:
type: string
position:
name: position
in: query
description: 'The position of a security rule
'
required: true
schema:
enum:
- pre
- post
default: pre
schemas:
internet-rule-type:
type: object
description: A simplified security rule for controlling internet access.
allOf:
- $ref: '#/components/schemas/base-rule-properties'
- type: object
properties:
negate_user:
type: boolean
default: false
devices:
type: array
items:
type: string
default:
- any
action:
enum:
- allow
- deny
default: allow
log_settings:
type: object
properties:
log_sessions:
type: boolean
default: true
security_settings:
type: object
properties:
anti_spyware:
type: string
enum:
- true
- false
default: true
vulnerability:
type: string
enum:
- true
- false
default: true
virus_and_wildfire_analysis:
type: string
enum:
- true
- false
default: true
block_web_application:
type: array
items:
type: string
block_url_category:
type: array
items:
type: string
allow_web_application:
type: array
items:
type: object
properties:
name:
type: string
type:
type: string
file_control:
type: object
properties:
upload:
type: string
enum:
- allow-all-file-types
- best-practice
- block-all-file-types
download:
type: string
enum:
- allow-all-file-types
- best-practice
- block-all-file-types
saas_enterprise_control:
type: object
properties:
consumer_access:
type: object
properties:
enable:
type: string
enum:
- true
- false
enterprise_access:
type: object
properties:
enable:
type: string
enum:
- true
- false
tenant_restrictions:
type: array
items:
type: string
application_function:
type: array
items:
type: string
dlp:
type: string
saas_tenant_list:
type: array
items:
type: string
saas_user_list:
type: array
items:
type: string
tenant_control:
type: object
properties:
tenants:
type: array
items:
type: string
allowed_activities:
type: array
items:
type: string
blocked_activities:
type: array
items:
type: string
parent_application:
type: string
allow_url_category:
type: array
items:
type: object
properties:
name:
type: string
decryption:
type: string
enum:
- enabled
- disabled
default: enabled
credential_enforcement:
type: string
enum:
- enabled
- disabled
default: enabled
additional_action:
type: string
enum:
- none
- continue
- redirect
- isolate
default: none
isolation_profiles:
type: string
default: none
file_control:
type: object
properties:
upload:
type: string
enum:
- allow-all-file-types
- best-practice
- block-all-file-types
download:
type: string
enum:
- allow-all-file-types
- best-practice
- block-all-file-types
dlp:
type: string
default_profile_settings:
type: object
properties:
file_control:
type: object
properties:
upload:
type: string
enum:
- allow-all-file-types
- best-practice
- block-all-file-types
download:
type: string
enum:
- allow-all-file-types
- best-practice
- block-all-file-types
dlp:
type: string
generic_error:
type: object
properties:
_errors:
$ref: '#/components/schemas/error_detail_cause_infos'
_request_id:
type: string
x-examples: {}
error_detail_cause_info:
type: object
title: Cause Info
properties:
code:
type: string
message:
type: string
details:
oneOf:
- type: string
- type: object
help:
type: string
security-rule-type:
type: object
required:
- from
- to
- source
- source_user
- destination
- service
- action
description: A standard security rule for controlling traffic between zones.
allOf:
- $ref: '#/components/schemas/base-rule-properties'
- type: object
required:
- category
- application
properties:
negate_destination:
type: boolean
description: Negate the destination addresses(es)?
default: false
source_hip:
type: array
description: The source Host Integrity Profile(s)
items:
type: string
default: any
destination_hip:
type: array
description: The destination Host Integrity Profile(s)
uniqueItems: true
items:
type: string
default: any
application:
type: array
description: The application(s) being accessed
uniqueItems: true
items:
type: string
default: any
category:
type: array
description: The URL categories being accessed
uniqueItems: true
items:
type: string
default: any
action:
enum:
- allow
- deny
- drop
- reset-client
- reset-server
- reset-both
description: The action to be taken when the rule is matched
profile_setting:
type: object
description: The security profile object
properties:
group:
type: array
description: The security profile group
items:
type: string
default: best-practice
log_setting:
type: string
description: The external log forwarding profile
log_start:
type: boolean
description: Log at session start?
log_end:
type: boolean
description: Log at session end?
tenant_restrictions:
type: array
items:
type: string
default: any
security-rules:
type: object
description: 'Represents a Security or Internet security rule.
A rule must be one of the policy types AND exist in one scope (folder, snippet, or device).'
allOf:
- oneOf:
- $ref: '#/components/schemas/security-rule-type'
- $ref: '#/components/schemas/internet-rule-type'
discriminator:
propertyName: policy_type
mapping:
Security: '#/components/schemas/security-rule-type'
Internet: '#/components/schemas/internet-rule-type'
- oneOf:
- type: object
title: folder
required:
- folder
properties:
folder:
type: string
pattern: ^[a-zA-Z\d\-_\. ]+$
maxLength: 64
description: The folder in which the resource is defined
- type: object
title: snippet
required:
- snippet
properties:
snippet:
type: string
pattern: ^[a-zA-Z\d\-_\. ]+$
maxLength: 64
description: The snippet in which the resource is defined
- type: object
title: device
required:
- device
properties:
device:
type: string
pattern: ^[a-zA-Z\d\-_\. ]+$
maxLength: 64
description: The device in which the resource is defined
error_detail_cause_infos:
type: array
items:
$ref: '#/components/schemas/error_detail_cause_info'
x-examples: {}
base-rule-properties:
type: object
required:
- name
properties:
id:
type: string
description: The UUID of the security rule
format: uuid
readOnly: true
example: 123e4567-e89b-12d3-a456-426655440000
name:
type: string
description: The name of the security rule
policy_type:
type: string
default: Security
disabled:
type: boolean
description: Is the security rule disabled?
default: false
description:
type: string
description: The description of the security rule
tag:
type: array
description: The tags associated with the security rule
uniqueItems: true
items:
type: string
from:
type: array
description: The source security zone(s)
uniqueItems: true
items:
type: string
default: any
to:
type: array
description: The destination security zone(s)
uniqueItems: true
items:
type: string
default: any
source:
type: array
description: The source addresses(es)
uniqueItems: true
items:
type: string
default: any
negate_source:
type: boolean
description: Negate the source address(es)?
default: false
source_user:
type: array
description: List of source users and/or groups. Reserved words include `any`, `pre-login`, `known-user`, and `unknown`.
uniqueItems: true
items:
type: string
default: any
destination:
type: array
description: The destination address(es)
uniqueItems: true
items:
type: string
default: any
service:
type: array
description: The service(s) being accessed
uniqueItems: true
items:
type: string
default: any
schedule:
type: string
description: Schedule in which this rule will be applied
action:
enum:
- allow
- deny
- drop
- reset-client
- reset-server
- reset-both
description: The action to be taken when the rule is matched
SecurityRuleListResponse:
type: object
properties:
data:
type: array
items:
$ref: '#/components/schemas/security-rules'
limit:
type: integer
default: 200
offset:
type: integer
default: 0
total:
type: integer
rule-based-move:
type: object
title: rule-based-move
properties:
destination:
enum:
- top
- bottom
- before
- after
description: A destination of the rule. Valid destination values are top, bottom, before and after.
rulebase:
enum:
- pre
- post
description: A base of a rule. Valid rulebase values are pre and post.
destination_rule:
type: string
description: A destination_rule attribute is required only if the destination value is before or after. Valid destination_rule values are existing rule UUIDs within the same container.
required:
- destination
- rulebase
responses:
http_ok:
description: OK
not_found:
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
object_not_present:
$ref: '#/components/examples/json_404_panui_mgmt_object_not_present'
default_errors:
description: General Errors
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
version_not_supported:
$ref: '#/components/examples/json_501_panui_restapi_version_not_supported'
method_not_allowed:
$ref: '#/components/examples/json_501_panui_restapi_method_not_supported'
action_not_supported:
$ref: '#/components/examples/json_405_panui_restapi_action_not_supported'
bad_xpath:
$ref: '#/components/examples/json_400_panui_mgmt_bad_xpath'
invalid_command:
$ref: '#/components/examples/json_400_panui_mgmt_invalid_command'
malformed_command:
$ref: '#/components/examples/json_400_panui_mgmt_malformed_command'
session_timeout:
$ref: '#/components/examples/json_504_panui_mgmt_session_timeout'
bad_request_errors_basic_with_body:
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
input_format_mismatch:
$ref: '#/components/examples/json_400_panui_restapi_input_format_mismatch'
output_format_mismatch:
$ref: '#/components/examples/json_400_panui_restapi_output_format_mismatch'
missing_query_parameter:
$ref: '#/components/examples/json_400_panui_restapi_missing_query_parameter'
invalid_query_parameter:
$ref: '#/components/examples/json_400_panui_restapi_invalid_query_parameter'
missing_body:
$ref: '#/components/examples/json_400_panui_restapi_missing_body'
invalid_object:
$ref: '#/components/examples/json_400_panui_mgmt_invalid_object'
bad_request_errors_basic:
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
input_format_mismatch:
$ref: '#/components/examples/json_400_panui_restapi_input_format_mismatch'
output_format_mismatch:
$ref: '#/components/examples/json_400_panui_restapi_output_format_mismatch'
missing_query_parameter:
$ref: '#/components/examples/json_400_panui_restapi_missing_query_parameter'
invalid_query_parameter:
$ref: '#/components/examples/json_400_panui_restapi_invalid_query_parameter'
auth_errors:
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
auth_not_authenticated:
$ref: '#/components/examples/json_401_panui_auth_not_authenticated'
invalid_credential:
$ref: '#/components/examples/json_401_panui_auth_invalid_credential'
key_too_long:
$ref: '#/components/examples/json_401_panui_auth_key_too_long'
key_expired:
$ref: '#/components/examples/json_401_panui_auth_key_expired'
need_password_change:
$ref: '#/components/examples/json_401_panui_auth_need_password_change'
conflict_errors:
description: Conflict
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
object_not_unique:
$ref: '#/components/examples/json_409_panui_mgmt_object_not_unique'
name_not_unique:
$ref: '#/components/examples/json_409_panui_mgmt_name_not_unique'
reference_not_zero:
$ref: '#/components/examples/json_409_panui_mgmt_reference_not_zero'
access_errors:
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
auth_unauthorized:
$ref: '#/components/examples/json_403_panui_auth_unauthorized'
securitySchemes:
scmOAuth:
type: oauth2
description: "Strata Cloud Manager APIs authenticate client requests using the \nOAuth 2.0 Client Credentials flow. Please use the `client_id`, \n`client_secret` values associated with an IAM service account along \nwith a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is
# --- truncated at 32 KB (32 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-security-rules-api-openapi.yml