Palo Alto Networks

Palo Alto Networks Subnet API

The Subnet API from Palo Alto Networks — 3 operation(s) for subnet.

GitHub OpenAPI

Operations 6

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /sse/connector/v2.0/api/subnets List connector subnets · List Subnets #
Ask an LLM
“Which subnets are defined in my ZTNA connector setup?”
“Can I search or filter the connector subnet list?”
Tell an agent
List connector subnets matching {search}.
Show connector subnets in region {x-panw-region} sorted by {sort}.
POST /sse/connector/v2.0/api/subnets Create a connector subnet · Create Subnet #
Ask an LLM
“How do I add a subnet to a connector group?”
“Can I allow ICMP when I define a new connector subnet?”
Tell an agent
Create connector subnet {name} in group {group} covering {ip_subnets}.
Add subnet {name} to connector group {group} with ICMP allowed set to {icmp_allowed}.
GET /sse/connector/v2.0/api/subnets/{oid} Get a connector subnet · Get Subnet #
Ask an LLM
“What IP ranges and group does a specific connector subnet have?”
“Can I look up one connector subnet by its object ID?”
Tell an agent
Show connector subnet {oid}.
Get the details of subnet object {oid}.
PUT /sse/connector/v2.0/api/subnets/{oid} Update a connector subnet · Update Subnet #
Ask an LLM
“Can I change the IP ranges on an existing connector subnet?”
“Is it possible to move a connector subnet to another group?”
Tell an agent
Update connector subnet {oid} to cover {ip_subnets}.
Move subnet {oid} into connector group {group}.
DELETE /sse/connector/v2.0/api/subnets/{oid} Delete a connector subnet · Delete Subnet #
Ask an LLM
“How do I remove a subnet from my connector configuration?”
“Does deleting a connector subnet cut off access to that IP range?”
Tell an agent destructive · confirm first
Delete connector subnet {oid}.
Remove subnet object {oid} from the connector setup.
GET /sse/connector/v2.0/api/subnets/filters Get filter values for subnet fields · List Subnet Filters #
Ask an LLM
“What values can I filter connector subnets on for a given field?”
“Which distinct groups appear across my connector subnets?”
Tell an agent
Get the available filter values for subnet field {field}.
Look up subnet filter options for {field} matching {search}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-subnet-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-subnet-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-subnet-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: ZTNA Connector Restful Subnet API
  version: v2
  license:
    name: Palo Alto Networks EULA
    url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  description: ZTNA Connector Restful API Specification This Open API spec file was created on March 25, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
servers:
- url: https://api.sase.paloaltonetworks.com
security:
- bearerAuth: []
tags:
- name: Subnet
paths:
  /sse/connector/v2.0/api/subnets:
    get:
      summary: List Subnets
      description: Retrieve the subnets details through this Application Programming Interface endpoint.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/subnet_rule.list'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/pagination.offset'
      - $ref: '#/components/parameters/pagination.limit'
      - $ref: '#/components/parameters/query.sort'
      - $ref: '#/components/parameters/query.search'
      - $ref: '#/components/parameters/query.filters'
      tags:
      - Subnet
      operationId: list.subnet_rules.v2
    post:
      summary: Create Subnet
      description: Create the subnets details through this Application Programming Interface endpoint.
      responses:
        '201':
          $ref: '#/components/responses/http.201_created'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
        '403':
          $ref: '#/components/responses/error-403'
        '409':
          $ref: '#/components/responses/error-409'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      tags:
      - Subnet
      operationId: create.subnet_rule.v2
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/subnet_rule-new'
  /sse/connector/v2.0/api/subnets/{oid}:
    get:
      summary: Get Subnet
      description: Retrieve the {oid} details through this Application Programming Interface endpoint.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/subnet_rule-existing'
                - $ref: '#/components/schemas/entity_meta'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
        '404':
          $ref: '#/components/responses/error-404'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/path.oid'
      tags:
      - Subnet
      operationId: get.subnet_rule.v2
    put:
      summary: Update Subnet
      description: Update the {oid} details through this Application Programming Interface endpoint.
      responses:
        '200':
          $ref: '#/components/responses/http.200_ok'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
        '403':
          $ref: '#/components/responses/error-403'
        '404':
          $ref: '#/components/responses/error-404'
        '409':
          $ref: '#/components/responses/error-409'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/path.oid'
      tags:
      - Subnet
      operationId: update.subnet_rule.v2
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/subnet_rule-existing'
    delete:
      summary: Delete Subnet
      description: Delete the {oid} details through this Application Programming Interface endpoint.
      responses:
        '202':
          $ref: '#/components/responses/http.202_accepted'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
        '403':
          $ref: '#/components/responses/error-403'
        '404':
          $ref: '#/components/responses/error-404'
        '409':
          $ref: '#/components/responses/error-409'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/path.oid'
      tags:
      - Subnet
      operationId: delete.subnet_rule.v2
  /sse/connector/v2.0/api/subnets/filters:
    get:
      summary: List Subnet Filters
      description: Get filter values for subnet rule fields.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/filters'
              examples:
                empty:
                  $ref: '#/components/examples/filter-empty'
                common:
                  $ref: '#/components/examples/filter'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/query.field'
      - $ref: '#/components/parameters/query.search'
      tags:
      - Subnet
      operationId: list.subnet_rules.filters.v2
components:
  schemas:
    subnet_rule.list:
      type: object
      properties:
        data:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/subnet_rule-existing'
            - $ref: '#/components/schemas/entity_meta'
        total:
          $ref: '#/components/schemas/pagination.total'
        limit:
          $ref: '#/components/schemas/pagination.limit'
        offset:
          $ref: '#/components/schemas/pagination.offset'
      required:
      - data
      - total
      - offset
      - limit
    subnet_rule-new:
      type: object
      properties:
        name:
          type: string
          description: 'Name of the IP Subnet rule.


            It can only be 64 characters long

            and contain unicode text, space, dash, or underscore, or period.'
          maxLength: 64
          minLength: 1
          pattern: ^[\p{L}\p{N}\p{P}\s,.:_-]*$
        description:
          type: string
          maxLength: 64
          pattern: ^[\p{L}\p{N}\p{P}\s,.:_-]*$
        group:
          type: string
          description: A comma separated list of [connector group id](#tag/connector-group/operation/list.connector_group.v2)
        ip_subnets:
          type: string
          description: IPv4 subnet in CIDR notation (x.x.x.x/y)
        app_enabled:
          type: boolean
          description: 'Whether the IP subnet rule is enabled.


            If omitted, defaults to false.'
        icmp_allowed:
          type: boolean
          description: 'Whether ICMP is allowed for this IP subnet rule.


            If omitted, defaults to true.'
      required:
      - name
      - group
      - ip_subnets
    pagination.limit:
      type: integer
      title: The manimum number of objects to return
    pagination.total:
      type: integer
      title: The total number of objects
    subnet_rule-existing:
      type: object
      properties:
        oid:
          description: Id of the entry.
          type: string
          readOnly: true
        name:
          type: string
          description: 'Name of the IP Subnet rule.


            It can only be 64 characters long

            and contain unicode text, space, dash, or underscore, or period.'
          maxLength: 64
          minLength: 1
          pattern: ^[\p{L}\p{N}\p{P}\s,.:_-]*$
        description:
          type: string
          maxLength: 64
          pattern: ^[\p{L}\p{N}\p{P}\s,.:_-]*$
        group:
          type: string
          description: A comma separated list of [connector group id](#tag/connector-group/operation/list.connector_group.v2)
        ip_subnets:
          type: string
          description: IPv4 subnet in CIDR notation (x.x.x.x/y)
        app_enabled:
          type: boolean
          description: 'Whether the IP subnet rule is enabled.


            If omitted, defaults to false.'
        icmp_allowed:
          type: boolean
          description: 'Whether ICMP is allowed for this IP subnet rule.


            If omitted, defaults to true.'
      required:
      - oid
      - name
      - group
      - ip_subnets
    error_response:
      type: object
      description: Error response payload
      properties:
        error:
          $ref: '#/components/schemas/error_object'
      required:
      - error
    error_object:
      type: object
      description: Error object following Google Cloud API error format
      properties:
        code:
          type: string
          description: Error code
          example: INVALID_ARGUMENT
        message:
          type: string
          description: Human-readable error message
          example: Unable to find tenantID from TSG mapping or request
        details:
          type: array
          description: Additional error details
          items:
            $ref: '#/components/schemas/error_detail'
    entity_meta:
      type: object
      properties:
        created_time:
          type: string
        updated_time:
          type: string
    pagination.offset:
      type: integer
      title: The offset into the total number of objects
    filters:
      type: array
      items:
        type: string
    error_detail:
      type: object
      description: Error detail information following Google Cloud API CauseInfo format
      properties:
        '@type':
          type: string
          description: Type identifier for the detail object
          example: google-cloud-api/CauseInfo
        message:
          type: string
          description: Detailed error message
        causes:
          type: array
          description: Array of cause information objects
          items:
            type: object
            properties:
              message:
                type: string
                description: Cause message
              module:
                type: string
                description: Module where the cause originated
  responses:
    error-403:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    http.201_created:
      x-summary: Created
      description: '[201 Created](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/201)

        '
    error-400:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    error-401:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    error-404:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    error-409:
      description: Conflict
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    http.202_accepted:
      x-summary: Accepted
      description: '[202 Accepted](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/202)

        '
    http.200_ok:
      x-summary: OK
      description: '[200 OK](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/200)

        '
  parameters:
    pagination.limit:
      name: limit
      in: query
      required: false
      schema:
        type: integer
        minimum: 0
      description: The max count in result entry (count per page)
    query.field:
      name: field
      description: String that represents a static filter field. Call any of the /filters endpoints without specifying a field to get a list of all available fields.
      in: query
      schema:
        type: string
        example: connector_group
    query.sort:
      name: sort
      description: List of fields from item response to sort by.
      in: query
      schema:
        type: string
      examples:
        threeItems:
          value: A[asc],B[desc],C
          summary: An example sort list that sorts first by A in ascending order, then B in descending order, and finally C in ascending order.
    query.filters:
      name: filters
      description: String to filter list results by searching one specified field of an object. Multiple filters can be specified.
      in: query
      schema:
        type: string
      examples:
        freeFormFilter:
          value: '{"field":"name","search":"abc"}'
          summary: A free form filter on the field name searching for a substring match of abc.
        staticFilter:
          value: '{"field":"connector_group","filter":"abc"}'
          summary: A static filter on the field connector_group searching for an exact match of abc.
    path.oid:
      name: oid
      in: path
      description: Object ID
      required: true
      schema:
        type: string
    pagination.offset:
      name: offset
      description: 'A 0-based offset into the collection.

        It is the index of the starting entry of the page

        '
      in: query
      required: false
      schema:
        type: integer
        minimum: 0
    query.search:
      name: search
      description: String to filter list results by. Is searched over multiple fields in each object. Multiple searches can be specified.
      in: query
      schema:
        type: string
        example: connector1
    x-panw-region:
      name: x-panw-region
      description: The region of the tenant
      in: header
      schema:
        type: string
        enum:
        - ae
        - americas
        - au
        - br
        - ca
        - ch
        - cn
        - de
        - es
        - europe
        - fr
        - id
        - il
        - in
        - it
        - jp
        - kr
        - pl
        - qa
        - sa
        - sg
        - tw
        - uk
        - za
  examples:
    filter-empty:
      summary: when no filter value is available
      value: []
    filter:
      summary: common scenario
      value:
      - value 1
      - value 2
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT