Palo Alto Networks

Palo Alto Networks Service Accounts API

Service account management and credential generation.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 13

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /service-accounts List service accounts · Palo Alto Networks List Service Accounts #
Ask an LLM
“Which service accounts exist for API automation in my tenant?”
“Can I list service accounts for one Tenant Service Group only?”
Tell an agent
List all service accounts.
List service accounts in TSG {tsg_id}.
POST /service-accounts Create a service account · Palo Alto Networks Create Service Account #
Ask an LLM
“How do I create a machine identity for API automation?”
“Which Tenant Service Group does a new service account have to belong to?”
Tell an agent
Create service account {name} in TSG {tsg_id}.
Add service account {name} to TSG {tsg_id} described as {description}.
GET /service-accounts/{id} Get a service account · Palo Alto Networks Get Service Account #
Ask an LLM
“What are the full details of one service account?”
“Can I look up a service account by its ID?”
Tell an agent
Get service account {id}.
Show details of service account {id}.
PUT /service-accounts/{id} Rename or re-describe a service account · Palo Alto Networks Update Service Account #
Ask an LLM
“Can I change a service account's display name?”
“Is it possible to update the description of an existing service account?”
Tell an agent
Set the display name of service account {id} to {display_name}.
Update the description of service account {id} to {description}.
DELETE /service-accounts/{id} Delete a service account · Palo Alto Networks Delete Service Account #
Ask an LLM
“What happens to active API sessions when I delete a service account?”
“How do I remove a service account and all its credentials?”
Tell an agent destructive · confirm first
Delete service account {id}.
Remove service account {id} and revoke all its credentials.
POST /service-accounts/{id}/keys Generate client credentials for a service account · Palo Alto Networks Generate Service Account Credentials #
Ask an LLM
“How do I get a client ID and secret for a service account?”
“Can I make service account credentials expire after a set number of days?”
Tell an agent
Generate new credentials for service account {id}.
Create a client secret for service account {id} that expires in {expires_in_days} days.
DELETE /service-accounts/{id}/keys/{key_id} Revoke a service account key · Palo Alto Networks Revoke Service Account Key #
Ask an LLM
“Can I revoke one leaked key without deleting the whole service account?”
“What happens to sessions using a key I revoke?”
Tell an agent destructive · confirm first
Revoke key {key_id} on service account {id}.
Invalidate credential {key_id} for service account {id}.
GET /iam/v1/service_accounts List service accounts · List all service accounts #
Ask an LLM
“Which service accounts exist in my Prisma SASE tenant?”
“Can I see every IAM service account at once?”
Tell an agent
List every service account through the IAM v1 endpoint.
Show me every IAM service account in the tenant.
POST /iam/v1/service_accounts Create a service account · Create a service account #
Ask an LLM
“How do I create a service account for an automation script?”
“Can I set a contact email on a new service account?”
Tell an agent
Create a service account named {name} with contact email {contact_email}.
Add service account {name} described as {description}.
DELETE /iam/v1/service_accounts/{id} Delete a service account · Delete a service account #
Ask an LLM
“How do I remove a service account that's no longer needed?”
“Can I delete a service account by ID?”
Tell an agent destructive · confirm first
Delete IAM v1 service account {id}.
Remove service account {id} from the tenant.
GET /iam/v1/service_accounts/{id} Get a service account · Get a service account #
Ask an LLM
“What are the details of one particular service account?”
“Can I read one service account through the IAM v1 API?”
Tell an agent
Fetch IAM v1 service account {id}.
Show the details of service account {id}.
PUT /iam/v1/service_accounts/{id} Update a service account · Update a service account #
Ask an LLM
“Can I change the contact email on an existing service account?”
“What fields of a service account can I edit?”
Tell an agent
Set the contact email of service account {id} to {contact_email}.
Change the IAM v1 description of service account {id} to {description}.
POST /iam/v1/service_accounts/{id}/operations/reset Reset a service account · Reset a service account #
Ask an LLM
“What does resetting a service account do?”
“Can I reset a compromised service account?”
Tell an agent destructive · confirm first
Reset service account {id}.
Run the reset operation on service account {id}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-service-accounts-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-service-accounts-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-service-accounts-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks SASE IAM Service Service Accounts API
  description: SASE Identity and Access Management (IAM) Service API. Provides programmatic management of service accounts, API key credentials, and access policies for the Palo Alto Networks SASE platform. Service accounts are machine identities used for API automation. Access policies bind roles to service accounts or users, controlling what operations they can perform within a Tenant Service Group scope.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.sase.paloaltonetworks.com/iam/v1
  description: SASE IAM Service API production server.
security:
- oauth2Bearer: []
tags:


# --- truncated at 32 KB (41 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-service-accounts-api-openapi.yml