Palo Alto Networks

Palo Alto Networks SSO API

On Prisma Cloud, you can enable single sign-on (SSO) using an Identity Provider (IdP) that supports Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), such as Okta, Microsoft Active Directory Federation Services (ADFS), Azure Active Directory (AD), Google, or OneLogin. Prisma Cloud System Administrators can use the following APIs to configure tenant SSO.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 8

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /authn/v1/saml/config Get the tenant SAML configuration · Get SAML Configuration #
Ask an LLM
“How is SAML single sign-on currently set up for my Prisma Cloud tenant?”
“Which identity provider and audience URI does our SAML setup use?”
Tell an agent
Show the tenant's SAML configuration.
Get our current SAML SSO settings.
PUT /authn/v1/saml/config Update the tenant SAML configuration · Update SAML Configuration #
Ask an LLM
“Can I rotate the IdP certificate on an existing SAML setup?”
“How do I turn on SAML auto-provisioning of users for an existing configuration?”
Tell an agent
Update the existing SAML config to use certificate {certificate}.
Change the SAML logout redirect URL to {logoutRedirectUrl}.
POST /authn/v1/saml/config Create the tenant SAML configuration · Create SAML Configuration #
Ask an LLM
“How do I set up SAML SSO for the first time on my tenant?”
“What do I need from my identity provider to create a SAML configuration?”
Tell an agent
Create a SAML configuration for identity provider {identityProvider} with certificate {certificate}.
Set up new SAML SSO with audience URI {audienceUri}.
GET /authn/api/v1/oauth2/config Get the tenant OIDC configuration · Get OIDC Configuration #
Ask an LLM
“What OpenID Connect settings does my tenant use for sign-in?”
“Which issuer and client ID is our OIDC login configured with?”
Tell an agent
Show the tenant's OIDC configuration.
Get our OAuth2 settings used for OpenID Connect.
PUT /authn/api/v1/oauth2/config Replace the tenant OIDC configuration · Update OIDC Configuration #
Ask an LLM
“How do I overwrite every setting of our OIDC configuration at once?”
“Can I replace the full OpenID Connect config with a new issuer and endpoints?”
Tell an agent
Replace the OIDC config with client {clientId}, issuer {issuer}, auth URI {idpAuthUri} and token URI {tokenUri}.
Overwrite all OIDC settings, requesting scopes {scopes}.
POST /authn/api/v1/oauth2/config Create the tenant OIDC configuration · Create an OIDC Configuration #
Ask an LLM
“How do I set up OpenID Connect sign-in for my tenant for the first time?”
“Can I enable PKCE when I first configure OIDC?”
Tell an agent
Create an OIDC configuration for client {clientId} with issuer {issuer}.
Set up new OpenID Connect login using token URI {tokenUri} and auth URI {idpAuthUri}.
PATCH /authn/api/v1/oauth2/config Partially update the tenant OIDC configuration · Update OIDC Configuration Partially #
Ask an LLM
“Can I change just one OIDC setting without resending the whole configuration?”
“How do I switch on just-in-time provisioning in our existing OIDC setup?”
Tell an agent
Patch only the OIDC client secret to {clientSecret}.
Change just the OIDC JIT provisioning flag to {isJitEnabled}.
GET /authn/api/v1/oauth2/login Get the OIDC login URL · Get OIDC Login URL #
Ask an LLM
“Where do users go to sign in to my tenant with OpenID Connect?”
“What's the OIDC login link for a specific user?”
Tell an agent
Get the OIDC login URL for my tenant.
Get the OIDC login URL for user {user_name}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-sso-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-sso-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-sso-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Authentication and RBAC API's SSO API
  contact:
    name: Platform
    url: https://panw-rnd.slack.com/archives/C01DQJBJ7LJ
  version: '1.0'
  description: On Prisma Cloud, you can enable single sign-on (SSO) using an Identity Provider (IdP) that supports Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), such as Okta, Microsoft Active Directory Federation Services (ADFS), Azure Active Directory (AD), Google, or OneLogin. Prisma Cloud System Administrators can use the following APIs to configure tenant SSO.
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
security:
- CertAuth: []
- ServiceJwt: []
- UserJwt: []
- x-redlock-auth: []
tags:
- name: SSO
  description: On Prisma Cloud, you can enable single sign-on (SSO) using an Identity Provider (IdP) that supports Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), such as Okta, Microsoft Active Directory Federation Services (ADFS), Azure Active Directory (AD), Google, or OneLogin. Prisma Cloud System Administrators can use the following APIs to configure tenant SSO.
paths:
  /authn/v1/saml/config:
    get:
      tags:
      - SSO
      summary: Get SAML Configuration
      description: Used by System Admins to get the SAML Configuration for the tenancy
      operationId: get-saml-config
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SsoConfig'
        '401':
          description: Authentication error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SsoConfig'
        '403':
          description: Authorization error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SsoConfig'
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SsoConfig'
      security:
      - x-redlock-auth: []
      x-microservice: 'true'
      x-public: 'true'
    put:
      tags:
      - SSO
      summary: Update SAML Configuration
      description: Used by System Admins to update the SAML Configuration for the tenancy
      operationId: update-saml-config
      parameters:
      - name: clientIp
        in: header
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SsoConfig'
        required: true
      responses:
        '200':
          description: Successful operation
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
        '403':
          description: Authorization error
        '429':
          description: Too many requests
      security:
      - x-redlock-auth: []
      x-microservice: 'true'
      x-public: 'true'
    post:
      tags:
      - SSO
      summary: Create SAML Configuration
      description: Used by System Admins to create the SAML Configuration for the tenancy
      operationId: create-saml-config
      parameters:
      - name: clientIp
        in: header
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SsoConfig'
        required: true
      responses:
        '200':
          description: Successful operation
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
        '403':
          description: Authorization error
        '429':
          description: Too many requests
      security:
      - x-redlock-auth: []
      x-microservice: 'true'
      x-public: 'true'
  /authn/api/v1/oauth2/config:
    get:
      tags:
      - SSO
      summary: Get OIDC Configuration
      description: Get the OAuth2 configuration details of a tenant that is used by OpenID Connect(OIDC).
      operationId: get-oauth2-config
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2ConfigDetail'
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2ConfigDetail'
        '403':
          description: Authorization error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2ConfigDetail'
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2ConfigDetail'
      security:
      - x-redlock-auth: []
      x-ga: 23.10.1
      x-public: 'true'
    put:
      tags:
      - SSO
      summary: Update OIDC Configuration
      description: Updates all the parameters of an existing OAuth2 configuration that is used by OpenID Connect(OIDC).
      operationId: update-oauth2-config
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuth2ConfigDetail'
        required: true
      responses:
        '204':
          description: Successful operation
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
        '403':
          description: Authorization error
        '429':
          description: Too many requests
      security:
      - x-redlock-auth: []
      x-ga: 23.10.1
      x-public: 'true'
    post:
      tags:
      - SSO
      summary: Create an OIDC Configuration
      description: Create an OAuth2 configuration for a given tenant to be used by OpenID Connect(OIDC).
      operationId: create-oauth2-config
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuth2ConfigDetail'
        required: true
      responses:
        '201':
          description: Successful operation
          content:
            application/json:
              schema:
                type: string
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
          content:
            application/json:
              schema:
                type: string
        '403':
          description: Authorization error
          content:
            application/json:
              schema:
                type: string
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                type: string
      security:
      - x-redlock-auth: []
      x-ga: 23.10.1
      x-public: 'true'
    patch:
      tags:
      - SSO
      summary: Update OIDC Configuration Partially
      description: Updates only the specified parameters of an existing OAuth2 configuration that is used by OpenID Connect(OIDC).
      operationId: patch-oauth2-config
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuth2ConfigDetail'
        required: true
      responses:
        '204':
          description: Successful operation
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
        '403':
          description: Authorization error
        '429':
          description: Too many requests
      security:
      - x-redlock-auth: []
      x-ga: 23.10.1
      x-public: 'true'
  /authn/api/v1/oauth2/login:
    get:
      tags:
      - SSO
      summary: Get OIDC Login URL
      description: Get the OIDC login URL for the tenant.
      operationId: get-oidc-login-url
      parameters:
      - name: user_name
        in: query
        description: User name requesting the login URL.
        required: false
        schema:
          type: string
      - name: prisma_id
        in: query
        description: Prisma ID for the tenant of the user requesting the login.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: string
              example:
                url: https://prismacloud.io/authn/api/v1/oauth2/authorization/b5229d13-d2a2-4469-b9f8-1912cb11c2eb
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
      x-ga: 23.10.1
      x-public: 'true'
      security:
      - x-redlock-auth: []
components:
  schemas:
    OAuth2ConfigDetail:
      required:
      - clientId
      - idpAuthUri
      - issuer
      - scopes
      - tokenUri
      type: object
      properties:
        id:
          type: string
          description: Id
          format: uuid
          readOnly: true
        prismaId:
          type: integer
          description: Prisma ID of the tenant.
          format: int64
          readOnly: true
        clientId:
          type: string
          description: Client ID obtained after Identity Provider(IdP) configuration.
        clientSecret:
          type: string
          description: Secret for the client id
          writeOnly: true
        issuer:
          type: string
          description: The identifier of the OpenID Connect(OIDC) provider.
        scopes:
          type: array
          description: Identifiers used to specify what access privileges are being requested.
          example: '[openid, email, profile]'
          items:
            type: string
            description: Identifiers used to specify what access privileges are being requested.
            example: '[openid, email, profile]'
        grantType:
          type: string
          description: Grant types are a way to specify how a client wants to interact with an Identity Provider(IdP).
          enum:
          - authorization_code
        withPkce:
          type: boolean
          description: Using proof key for code exchange(PKCE) as additional verification.  PKCE ensures that only the client that requests the access token can redeem it.
          enum:
          - true
          - false
        idpAuthUri:
          type: string
          description: The URL of the authentication endpoint on the Identity Provider(IdP).
        tokenUri:
          type: string
          description: The Identity Provider token endpoint URL for obtaining access and ID tokens.
        jwkSetUri:
          type: string
          description: The URL of the Identity Provider(IdP) JSON Web Key Set document.This document contains signing keys that are used to validate the signatures from the provider.
        endSessionUri:
          type: string
          description: The URL used to sign out the user from the Identity Provider(IdP).
        isActive:
          type: boolean
          description: True to enable SSO using OIDC; False otherwise.
          enum:
          - true
          - false
        isJitEnabled:
          type: boolean
          description: Is JIT enabled
          enum:
          - true
          - false
        jitRoleClaimName:
          type: string
          description: Token claim providing the name of Prisma Cloud role for user.
        jitDefaultRoleId:
          type: string
          description: Default Prisma Cloud role to use for JIT when claim is missing or undefined.
        pcAuthUri:
          type: string
          description: Prisma Cloud endpoint URL to begin the authentication flow.
          readOnly: true
        pcRelayUri:
          type: string
          description: Prisma Cloud callback endpoint URL from the IdP during authentication.
          readOnly: true
        lastLoginErrors:
          type: array
          description: Recent OIDC login errors.
          readOnly: true
          items:
            type: string
            description: Recent OIDC login errors.
            readOnly: true
        createdBy:
          type: string
          description: User who created the resource.
          readOnly: true
        createdTs:
          type: integer
          description: Created on timestamp.
          format: int64
          readOnly: true
        lastModifiedBy:
          type: string
          description: User who made the last update.
          readOnly: true
        lastModifiedTs:
          type: integer
          description: Last update timestamp.
          format: int64
          readOnly: true
        clientSecretIsBlank:
          type: boolean
          description: True if client secret is not configured; False otherwise.
          readOnly: true
          enum:
          - true
          - false
    ErrorDetails:
      required:
      - message
      - name
      type: object
      properties:
        name:
          type: string
        message:
          type: string
    SsoConfig:
      type: object
      properties:
        identityProvider:
          type: string
          description: Identity Provider Issuer URI
        certificate:
          type: string
          description: Identity Provider Certificate
        enabled:
          type: boolean
          description: Is the configuration enabled?
          default: false
        logoutRedirectUrl:
          type: string
          description: Identity Provider Logout URL
        relayStateParamName:
          type: string
          description: Identity Provider Relay State Param
        lastLoginErrors:
          type: array
          description: Last Login Errors
          readOnly: true
          items:
            type: string
            description: Last Login Errors
            readOnly: true
        audienceUri:
          type: string
          description: Audience URI or Prisma Cloud SP-Entity-Id
          readOnly: true
        autoProvisionEnabled:
          type: boolean
          description: Enable JIT provisioning
          default: false
        requireAccessSamlUrlPublic:
          type: boolean
          description: Skip Public address check for Access SAML URL
          default: true
        autoProvisionSamlEmail:
          type: string
          description: JIT provisioning SAML Attribute - Email
        autoProvisionSamlFirstName:
          type: string
          description: JIT provisioning SAML Attribute - First name
        autoProvisionSamlLastName:
          type: string
          description: JIT provisioning SAML Attribute - Last name
        autoProvisionSamlRole:
          type: string
          description: JIT provisioning SAML Attribute - Role
        autoProvisionSamlTimezone:
          type: string
          description: JIT provisioning SAML Attribute - TZ
        redLockAccessSamlUrl:
          type: string
          description: Identity Provider Configured Prisma Cloud Access URL
    SpringErrorResponse:
      required:
      - error
      - message
      - path
      - status
      - timestamp
      type: object
      properties:
        timestamp:
          type: string
        status:
          type: integer
          format: int32
        error:
          type: string
        errorDetails:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetails'
        message:
          type: string
        path:
          type: string
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
externalDocs:
  description: Platform Wiki Documentation
  url: https://redlock.atlassian.net/wiki/spaces/RED/pages/2744877602/Platform+AuthN+Integration+Template