Palo Alto Networks Service Accounts API

openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend Service Accounts API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: Service Accounts
  description: Service account management and credential generation.
paths:
  /service-accounts:
    get:
      operationId: listServiceAccounts
      summary: Palo Alto Networks List Service Accounts
      description: Returns the list of service accounts for the authenticated tenant. Service accounts are machine identities used to authenticate API automation workflows using the client_credentials OAuth 2.0 grant.
      tags:
      - Service Accounts
      parameters:
      - name: tsg_id
        in: query
        description: Filter service accounts by Tenant Service Group ID.
        schema:
          type: string
        example: '863313'
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of service accounts to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Service accounts returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/ServiceAccount'
              examples:
                ListServiceAccounts200Example:
                  summary: Default listServiceAccounts 200 response
                  x-microcks-default: true
                  value:
                    total: 799
                    offset: 654
                    limit: 730
                    items:
                    - id: example-id
                      name: Branch Agent 97
                      display_name: Sarah Wilson
                      description: Investigation suspicious blocked threat on firewall suspicious Security Security alert investigation.
                      tsg_id: '758466'
                      key_count: 11
                      created_at: '2026-11-23T17:14:36Z'
                      updated_at: '2025-05-26T22:44:02Z'
                    - id: example-id
                      name: Branch Agent 97
                      display_name: Sarah Wilson
                      description: Investigation suspicious blocked threat on firewall suspicious Security Security alert investigation.
                      tsg_id: '758466'
                      key_count: 11
                      created_at: '2026-11-23T17:14:36Z'
                      updated_at: '2025-05-26T22:44:02Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListServiceAccounts400Example:
                  summary: Default listServiceAccounts 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListServiceAccounts401Example:
                  summary: Default listServiceAccounts 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListServiceAccounts403Example:
                  summary: Default listServiceAccounts 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListServiceAccounts500Example:
                  summary: Default listServiceAccounts 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createServiceAccount
      summary: Palo Alto Networks Create Service Account
      description: Creates a new service account. After creation, use the POST /service-accounts/{id}/keys endpoint to generate credentials. Service accounts are scoped to a Tenant Service Group and must be assigned access policies to grant API permissions.
      tags:
      - Service Accounts
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountRequest'
            examples:
              CreateServiceAccountRequestExample:
                summary: Default createServiceAccount request
                x-microcks-default: true
                value:
                  name: Primary Policy 99
                  display_name: Priya Chen
                  description: Traffic malware configured firewall suspicious investigation activity applied on incident.
                  tsg_id: '512892'
      responses:
        '201':
          description: Service account created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount'
              examples:
                CreateServiceAccount201Example:
                  summary: Default createServiceAccount 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Agent 97
                    display_name: Sarah Wilson
                    description: Investigation suspicious blocked threat on firewall suspicious Security Security alert investigation.
                    tsg_id: '758466'
                    key_count: 11
                    created_at: '2026-11-23T17:14:36Z'
                    updated_at: '2025-05-26T22:44:02Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateServiceAccount400Example:
                  summary: Default createServiceAccount 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateServiceAccount401Example:
                  summary: Default createServiceAccount 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateServiceAccount403Example:
                  summary: Default createServiceAccount 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '409':
          description: A service account with this name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateServiceAccount409Example:
                  summary: Default createServiceAccount 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateServiceAccount500Example:
                  summary: Default createServiceAccount 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /service-accounts/{id}:
    get:
      operationId: getServiceAccount
      summary: Palo Alto Networks Get Service Account
      description: Returns full details for a specific service account.
      tags:
      - Service Accounts
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the service account.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Service account details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount'
              examples:
                GetServiceAccount200Example:
                  summary: Default getServiceAccount 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Agent 97
                    display_name: Sarah Wilson
                    description: Investigation suspicious blocked threat on firewall suspicious Security Security alert investigation.
                    tsg_id: '758466'
                    key_count: 11
                    created_at: '2026-11-23T17:14:36Z'
                    updated_at: '2025-05-26T22:44:02Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetServiceAccount401Example:
                  summary: Default getServiceAccount 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetServiceAccount403Example:
                  summary: Default getServiceAccount 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '404':
          description: Service account not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetServiceAccount404Example:
                  summary: Default getServiceAccount 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetServiceAccount500Example:
                  summary: Default getServiceAccount 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateServiceAccount
      summary: Palo Alto Networks Update Service Account
      description: Updates the display name or description of an existing service account.
      tags:
      - Service Accounts
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the service account to update.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceAccountUpdate'
            examples:
              UpdateServiceAccountRequestExample:
                summary: Default updateServiceAccount request
                x-microcks-default: true
                value:
                  display_name: Alex Kumar
                  description: Network on network threat policy threat traffic detected network endpoint incident configured.
      responses:
        '200':
          description: Service account updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccount'
              examples:
                UpdateServiceAccount200Example:
                  summary: Default updateServiceAccount 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Agent 97
                    display_name: Sarah Wilson
                    description: Investigation suspicious blocked threat on firewall suspicious Security Security alert investigation.
                    tsg_id: '758466'
                    key_count: 11
                    created_at: '2026-11-23T17:14:36Z'
                    updated_at: '2025-05-26T22:44:02Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateServiceAccount400Example:
                  summary: Default updateServiceAccount 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateServiceAccount401Example:
                  summary: Default updateServiceAccount 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateServiceAccount403Example:
                  summary: Default updateServiceAccount 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '404':
          description: Service account not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateServiceAccount404Example:
                  summary: Default updateServiceAccount 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateServiceAccount500Example:
                  summary: Default updateServiceAccount 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteServiceAccount
      summary: Palo Alto Networks Delete Service Account
      description: Deletes a service account and revokes all associated credentials. Any active API sessions using credentials from this account will be invalidated.
      tags:
      - Service Accounts
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the service account to delete.
        schema:
          type: string
        example: example-id
      responses:
        '204':
          description: Service account deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteServiceAccount401Example:
                  summary: Default deleteServiceAccount 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteServiceAccount403Example:
                  summary: Default deleteServiceAccount 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '404':
          description: Service account not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteServiceAccount404Example:
                  summary: Default deleteServiceAccount 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteServiceAccount500Example:
                  summary: Default deleteServiceAccount 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /service-accounts/{id}/keys:
    post:
      operationId: generateServiceAccountCredentials
      summary: Palo Alto Networks Generate Service Account Credentials
      description: Generates a new client ID and client secret for a service account. The client secret is returned only once in the response and cannot be retrieved again. Store the credentials securely. Use these credentials with the OAuth 2.0 client_credentials grant to obtain Bearer tokens for API authentication.
      tags:
      - Service Accounts
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the service account.
        schema:
          type: string
        example: example-id
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  type: string
                  description: Optional description for this set of credentials.
                expires_in_days:
                  type: integer
                  description: Number of days until the credentials expire. If omitted, credentials do not expire.
                  minimum: 1
                  maximum: 365
            examples:
              GenerateServiceAccountCredentialsRequestExample:
                summary: Default generateServiceAccountCredentials request
                x-microcks-default: true
                value:
                  description: Applied traffic investigation network Security endpoint investigation.
                  expires_in_days: 79
      responses:
        '201':
          description: Credentials generated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceAccountCredentials'
              examples:
                GenerateServiceAccountCredentials201Example:
                  summary: Default generateServiceAccountCredentials 201 response
                  x-microcks-default: true
                  value:
                    key_id: '805173'
                    client_id: '846434'
                    client_secret: example-client_secret
                    description: Suspicious on firewall policy applied violation rule policy policy.
                    expires_at: '2024-05-22T20:49:01Z'
                    created_at: '2024-09-21T21:03:36Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GenerateServiceAccountCredentials401Example:
                  summary: Default generateServiceAccountCredentials 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GenerateServiceAccountCredentials403Example:
                  summary: Default generateServiceAccountCredentials 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '404':
          description: Service account not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GenerateServiceAccountCredentials404Example:
                  summary: Default generateServiceAccountCredentials 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GenerateServiceAccountCredentials500Example:
                  summary: Default generateServiceAccountCredentials 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /service-accounts/{id}/keys/{key_id}:
    delete:
      operationId: revokeServiceAccountKey
      summary: Palo Alto Networks Revoke Service Account Key
      description: Revokes a specific set of credentials for a service account. Any active API sessions using these credentials will be invalidated immediately.
      tags:
      - Service Accounts
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the service account.
        schema:
          type: string
        example: example-id
      - name: key_id
        in: path
        required: true
        description: Unique identifier of the key to revoke.
        schema:
          type: string
        example: '973646'
      responses:
        '204':
          description: Credentials revoked successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RevokeServiceAccountKey401Example:
                  summary: Default revokeServiceAccountKey 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RevokeServiceAccountKey403Example:
                  summary: Default revokeServiceAccountKey 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '404':
          description: Service account or key not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RevokeServiceAccountKey404Example:
                  summary: Default revokeServiceAccountKey 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RevokeServiceAccountKey500Example:
                  summary: Default revokeServiceAccountKey 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware endpoint traffic incident on on traffic rule endpoint traffic.
                    request_id: 1e1e39dd-16dd-4699-a272-365b75e92268
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ServiceAccount:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the service account.
          example: example-id
        name:
          type: string
          description: Unique name of the service account within the TSG.
          example: Branch Agent 97
        display_name:
          type: string
          description: Human-readable display name.
          example: Sarah Wilson
        description:
          type: string
          description: Description of the service account's purpose.
          example: Investigation suspicious blocked threat on firewall suspicious Security Security alert investigation.
        tsg_id:
          type: string
          description: Tenant Service Group ID this service account belongs to.
          example: '758466'
        key_count:
          type: integer
          description: Number of active credential keys for this s

# --- truncated at 32 KB (35 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-service-accounts-api-openapi.yml