Palo Alto Networks Subnet Rules API
Subnet-based access rules for ZTNA network segments.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/palo-alto-networks-subnet-rules-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks Subnet Rules API
contact:
name: Palo Alto Networks Developer Support
url: https://pan.dev/
license:
name: Proprietary
url: https://www.paloaltonetworks.com/legal
version: '1.0'
description: 'Operations tagged Subnet Rules across 2 of this provider''s published API definitions: palo-alto-networks-subnet-rules-api-openapi.yml, palo-alto-ztna-connector-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
- url: https://api.sase.paloaltonetworks.com/ztna
description: SASE ZTNA Connector API production server.
security:
- oauth2Bearer: []
tags:
- name: Subnet Rules
description: Subnet-based access rules for ZTNA network segments.
paths:
/v2/subnet-rules:
get:
operationId: listSubnetRules
summary: Palo Alto Networks List Subnet-based Access Rules
description: Returns the list of subnet-based access rules that define which IP network ranges are accessible through ZTNA connectors.
tags:
- Subnet Rules
responses:
'200':
description: Subnet rules returned.
content:
application/json:
schema:
type: object
properties:
total:
type: integer
items:
type: array
items:
$ref: '#/components/schemas/SubnetRule'
examples:
ListSubnetRules200Example:
summary: Default listSubnetRules 200 response
x-microcks-default: true
value:
total: 295
items:
- rule_id: '373292'
name: Corporate Firewall 37
subnet: 10.131.182.0/24
group_id: '527569'
enabled: false
created_at: '2025-04-09T20:01:23Z'
'401':
description: Invalid or missing Bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListSubnetRules401Example:
summary: Default listSubnetRules 401 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'403':
description: Insufficient permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListSubnetRules403Example:
summary: Default listSubnetRules 403 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListSubnetRules500Example:
summary: Default listSubnetRules 500 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
post:
operationId: createSubnetRule
summary: Palo Alto Networks Create Subnet-based Access Rule
description: Creates a new subnet-based access rule for ZTNA.
tags:
- Subnet Rules
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/SubnetRuleRequest'
examples:
CreateSubnetRuleRequestExample:
summary: Default createSubnetRule request
x-microcks-default: true
value:
name: Production Firewall 11
subnet: 10.175.38.0/24
group_id: '115097'
enabled: true
responses:
'201':
description: Subnet rule created successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/SubnetRule'
examples:
CreateSubnetRule201Example:
summary: Default createSubnetRule 201 response
x-microcks-default: true
value:
rule_id: '373292'
name: Corporate Firewall 37
subnet: 10.131.182.0/24
group_id: '527569'
enabled: false
created_at: '2025-04-09T20:01:23Z'
'400':
description: Invalid request body.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
CreateSubnetRule400Example:
summary: Default createSubnetRule 400 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'401':
description: Invalid or missing Bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
CreateSubnetRule401Example:
summary: Default createSubnetRule 401 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'403':
description: Insufficient permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
CreateSubnetRule403Example:
summary: Default createSubnetRule 403 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
CreateSubnetRule500Example:
summary: Default createSubnetRule 500 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
description: AIOps for NGFW BPA API production server.
components:
schemas:
SubnetRuleRequest:
type: object
required:
- name
- subnet
- group_id
properties:
name:
type: string
description: Display name for the subnet rule.
example: Production Firewall 11
subnet:
type: string
description: CIDR notation subnet this rule covers.
example: 10.175.38.0/24
group_id:
type: string
description: Connector group to use for routing traffic to this subnet.
example: '115097'
enabled:
type: boolean
default: true
example: true
SubnetRule:
type: object
properties:
rule_id:
type: string
description: Unique identifier of the subnet rule.
example: '373292'
name:
type: string
description: Display name of the rule.
example: Corporate Firewall 37
subnet:
type: string
description: CIDR notation subnet this rule covers (e.g., 10.0.0.0/8).
example: 10.131.182.0/24
group_id:
type: string
description: Connector group used to route traffic to this subnet.
example: '527569'
enabled:
type: boolean
description: Whether this rule is active.
example: false
created_at:
type: string
format: date-time
example: '2025-04-09T20:01:23Z'
ErrorResponse:
type: object
properties:
error:
type: string
description: Error code identifying the error type.
example: example-error
message:
type: string
description: Human-readable description of the error.
example: Security firewall network configured traffic blocked threat.
request_id:
type: string
description: Request identifier for support correlation.
example: 709c60bb-8234-4bc4-938b-d0835224c350
securitySchemes:
oauth2Bearer:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.
x-refined-from:
- palo-alto-networks-subnet-rules-api-openapi.yml
- palo-alto-ztna-connector-api-openapi-original.yml