Palo Alto Networks Subnet API

openapi: 3.2.0
info:
  title: ZTNA Connector Restful Subnet API
  version: v2
  license:
    name: Palo Alto Networks EULA
    url: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  description: ZTNA Connector Restful API Specification This Open API spec file was created on March 25, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html). All other marks mentioned herein may be trademarks of their respective companies.
servers:
- url: https://api.sase.paloaltonetworks.com
security:
- bearerAuth: []
tags:
- name: Subnet
paths:
  /sse/connector/v2.0/api/subnets:
    get:
      summary: List Subnets
      description: Retrieve the subnets details through this Application Programming Interface endpoint.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/subnet_rule.list'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/pagination.offset'
      - $ref: '#/components/parameters/pagination.limit'
      - $ref: '#/components/parameters/query.sort'
      - $ref: '#/components/parameters/query.search'
      - $ref: '#/components/parameters/query.filters'
      tags:
      - Subnet
      operationId: list.subnet_rules.v2
    post:
      summary: Create Subnet
      description: Create the subnets details through this Application Programming Interface endpoint.
      responses:
        '201':
          $ref: '#/components/responses/http.201_created'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
        '403':
          $ref: '#/components/responses/error-403'
        '409':
          $ref: '#/components/responses/error-409'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      tags:
      - Subnet
      operationId: create.subnet_rule.v2
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/subnet_rule-new'
  /sse/connector/v2.0/api/subnets/{oid}:
    get:
      summary: Get Subnet
      description: Retrieve the {oid} details through this Application Programming Interface endpoint.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/subnet_rule-existing'
                - $ref: '#/components/schemas/entity_meta'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
        '404':
          $ref: '#/components/responses/error-404'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/path.oid'
      tags:
      - Subnet
      operationId: get.subnet_rule.v2
    put:
      summary: Update Subnet
      description: Update the {oid} details through this Application Programming Interface endpoint.
      responses:
        '200':
          $ref: '#/components/responses/http.200_ok'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
        '403':
          $ref: '#/components/responses/error-403'
        '404':
          $ref: '#/components/responses/error-404'
        '409':
          $ref: '#/components/responses/error-409'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/path.oid'
      tags:
      - Subnet
      operationId: update.subnet_rule.v2
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/subnet_rule-existing'
    delete:
      summary: Delete Subnet
      description: Delete the {oid} details through this Application Programming Interface endpoint.
      responses:
        '202':
          $ref: '#/components/responses/http.202_accepted'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
        '403':
          $ref: '#/components/responses/error-403'
        '404':
          $ref: '#/components/responses/error-404'
        '409':
          $ref: '#/components/responses/error-409'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/path.oid'
      tags:
      - Subnet
      operationId: delete.subnet_rule.v2
  /sse/connector/v2.0/api/subnets/filters:
    get:
      summary: List Subnet Filters
      description: Get filter values for subnet rule fields.
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/filters'
              examples:
                empty:
                  $ref: '#/components/examples/filter-empty'
                common:
                  $ref: '#/components/examples/filter'
        '400':
          $ref: '#/components/responses/error-400'
        '401':
          $ref: '#/components/responses/error-401'
      parameters:
      - $ref: '#/components/parameters/x-panw-region'
      - $ref: '#/components/parameters/query.field'
      - $ref: '#/components/parameters/query.search'
      tags:
      - Subnet
      operationId: list.subnet_rules.filters.v2
components:
  examples:
    filter-empty:
      summary: when no filter value is available
      value: []
    filter:
      summary: common scenario
      value:
      - value 1
      - value 2
  schemas:
    pagination.total:
      type: integer
      title: The total number of objects
    subnet_rule-new:
      type: object
      properties:
        name:
          type: string
          description: 'Name of the IP Subnet rule.


            It can only be 64 characters long

            and contain unicode text, space, dash, or underscore, or period.'
          maxLength: 64
          minLength: 1
          pattern: ^[\p{L}\p{N}\p{P}\s,.:_-]*$
        description:
          type: string
          maxLength: 64
          pattern: ^[\p{L}\p{N}\p{P}\s,.:_-]*$
        group:
          type: string
          description: A comma separated list of [connector group id](#tag/connector-group/operation/list.connector_group.v2)
        ip_subnets:
          type: string
          description: IPv4 subnet in CIDR notation (x.x.x.x/y)
        app_enabled:
          type: boolean
          description: 'Whether the IP subnet rule is enabled.


            If omitted, defaults to false.'
        icmp_allowed:
          type: boolean
          description: 'Whether ICMP is allowed for this IP subnet rule.


            If omitted, defaults to true.'
      required:
      - name
      - group
      - ip_subnets
    pagination.limit:
      type: integer
      title: The manimum number of objects to return
    subnet_rule.list:
      type: object
      properties:
        data:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/subnet_rule-existing'
            - $ref: '#/components/schemas/entity_meta'
        total:
          $ref: '#/components/schemas/pagination.total'
        limit:
          $ref: '#/components/schemas/pagination.limit'
        offset:
          $ref: '#/components/schemas/pagination.offset'
      required:
      - data
      - total
      - offset
      - limit
    error_detail:
      type: object
      description: Error detail information following Google Cloud API CauseInfo format
      properties:
        '@type':
          type: string
          description: Type identifier for the detail object
          example: google-cloud-api/CauseInfo
        message:
          type: string
          description: Detailed error message
        causes:
          type: array
          description: Array of cause information objects
          items:
            type: object
            properties:
              message:
                type: string
                description: Cause message
              module:
                type: string
                description: Module where the cause originated
    pagination.offset:
      type: integer
      title: The offset into the total number of objects
    filters:
      type: array
      items:
        type: string
    entity_meta:
      type: object
      properties:
        created_time:
          type: string
        updated_time:
          type: string
    error_response:
      type: object
      description: Error response payload
      properties:
        error:
          $ref: '#/components/schemas/error_object'
      required:
      - error
    subnet_rule-existing:
      type: object
      properties:
        oid:
          description: Id of the entry.
          type: string
          readOnly: true
        name:
          type: string
          description: 'Name of the IP Subnet rule.


            It can only be 64 characters long

            and contain unicode text, space, dash, or underscore, or period.'
          maxLength: 64
          minLength: 1
          pattern: ^[\p{L}\p{N}\p{P}\s,.:_-]*$
        description:
          type: string
          maxLength: 64
          pattern: ^[\p{L}\p{N}\p{P}\s,.:_-]*$
        group:
          type: string
          description: A comma separated list of [connector group id](#tag/connector-group/operation/list.connector_group.v2)
        ip_subnets:
          type: string
          description: IPv4 subnet in CIDR notation (x.x.x.x/y)
        app_enabled:
          type: boolean
          description: 'Whether the IP subnet rule is enabled.


            If omitted, defaults to false.'
        icmp_allowed:
          type: boolean
          description: 'Whether ICMP is allowed for this IP subnet rule.


            If omitted, defaults to true.'
      required:
      - oid
      - name
      - group
      - ip_subnets
    error_object:
      type: object
      description: Error object following Google Cloud API error format
      properties:
        code:
          type: string
          description: Error code
          example: INVALID_ARGUMENT
        message:
          type: string
          description: Human-readable error message
          example: Unable to find tenantID from TSG mapping or request
        details:
          type: array
          description: Additional error details
          items:
            $ref: '#/components/schemas/error_detail'
  responses:
    error-404:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    error-400:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    error-403:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    http.201_created:
      x-summary: Created
      description: '[201 Created](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/201)

        '
    http.200_ok:
      x-summary: OK
      description: '[200 OK](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/200)

        '
    error-401:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    error-409:
      description: Conflict
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/error_response'
    http.202_accepted:
      x-summary: Accepted
      description: '[202 Accepted](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/202)

        '
  parameters:
    pagination.limit:
      name: limit
      in: query
      required: false
      schema:
        type: integer
        minimum: 0
      description: The max count in result entry (count per page)
    query.search:
      name: search
      description: String to filter list results by. Is searched over multiple fields in each object. Multiple searches can be specified.
      in: query
      schema:
        type: string
        example: connector1
    query.sort:
      name: sort
      description: List of fields from item response to sort by.
      in: query
      schema:
        type: string
      examples:
        threeItems:
          value: A[asc],B[desc],C
          summary: An example sort list that sorts first by A in ascending order, then B in descending order, and finally C in ascending order.
    pagination.offset:
      name: offset
      description: 'A 0-based offset into the collection.

        It is the index of the starting entry of the page

        '
      in: query
      required: false
      schema:
        type: integer
        minimum: 0
    query.field:
      name: field
      description: String that represents a static filter field. Call any of the /filters endpoints without specifying a field to get a list of all available fields.
      in: query
      schema:
        type: string
        example: connector_group
    path.oid:
      name: oid
      in: path
      description: Object ID
      required: true
      schema:
        type: string
    query.filters:
      name: filters
      description: String to filter list results by searching one specified field of an object. Multiple filters can be specified.
      in: query
      schema:
        type: string
      examples:
        freeFormFilter:
          value: '{"field":"name","search":"abc"}'
          summary: A free form filter on the field name searching for a substring match of abc.
        staticFilter:
          value: '{"field":"connector_group","filter":"abc"}'
          summary: A static filter on the field connector_group searching for an exact match of abc.
    x-panw-region:
      name: x-panw-region
      description: The region of the tenant
      in: header
      schema:
        type: string
        enum:
        - ae
        - americas
        - au
        - br
        - ca
        - ch
        - cn
        - de
        - es
        - europe
        - fr
        - id
        - il
        - in
        - it
        - jp
        - kr
        - pl
        - qa
        - sa
        - sg
        - tw
        - uk
        - za
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT