Subnet-based access rules for ZTNA network segments.
Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-subnet-rules-api"curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
title: Palo Alto Networks ZTNA Connector Subnet Rules API
description: ZTNA Connector API for zero trust network access management. Provides programmatic control over ZTNA connectors, connector groups, protected applications, FQDN-based access rules, subnet-based access rules, and license information. Connectors are software agents deployed in private network environments that provide secure access paths for ZTNA-protected applications without requiring inbound firewall rules. Part of the Palo Alto Networks SASE platform.
version: '2.0'
contact:
name: Palo Alto Networks Developer Support
url: https://pan.dev/
license:
name: Proprietary
url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.sase.paloaltonetworks.com/ztna
description: SASE ZTNA Connector API production server.
security:
- oauth2Bearer: []
tags:
- name: Subnet Rules
description: Subnet-based access rules for ZTNA network segments.
paths:
/v2/subnet-rules:
get:
operationId: listSubnetRules
summary: Palo Alto Networks List Subnet-based Access Rules
description: Returns the list of subnet-based access rules that define which IP network ranges are accessible through ZTNA connectors.
tags:
- Subnet Rules
responses:
'200':
description: Subnet rules returned.
content:
application/json:
schema:
type: object
properties:
total:
type: integer
items:
type: array
items:
$ref: '#/components/schemas/SubnetRule'
examples:
ListSubnetRules200Example:
summary: Default listSubnetRules 200 response
x-microcks-default: true
value:
total: 295
items:
- rule_id: '373292'
name: Corporate Firewall 37
subnet: 10.131.182.0/24
group_id: '527569'
enabled: false
created_at: '2025-04-09T20:01:23Z'
'401':
description: Invalid or missing Bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListSubnetRules401Example:
summary: Default listSubnetRules 401 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'403':
description: Insufficient permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListSubnetRules403Example:
summary: Default listSubnetRules 403 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
ListSubnetRules500Example:
summary: Default listSubnetRules 500 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
post:
operationId: createSubnetRule
summary: Palo Alto Networks Create Subnet-based Access Rule
description: Creates a new subnet-based access rule for ZTNA.
tags:
- Subnet Rules
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/SubnetRuleRequest'
examples:
CreateSubnetRuleRequestExample:
summary: Default createSubnetRule request
x-microcks-default: true
value:
name: Production Firewall 11
subnet: 10.175.38.0/24
group_id: '115097'
enabled: true
responses:
'201':
description: Subnet rule created successfully.
content:
application/json:
schema:
$ref: '#/components/schemas/SubnetRule'
examples:
CreateSubnetRule201Example:
summary: Default createSubnetRule 201 response
x-microcks-default: true
value:
rule_id: '373292'
name: Corporate Firewall 37
subnet: 10.131.182.0/24
group_id: '527569'
enabled: false
created_at: '2025-04-09T20:01:23Z'
'400':
description: Invalid request body.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
CreateSubnetRule400Example:
summary: Default createSubnetRule 400 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'401':
description: Invalid or missing Bearer token.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
CreateSubnetRule401Example:
summary: Default createSubnetRule 401 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'403':
description: Insufficient permissions.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
CreateSubnetRule403Example:
summary: Default createSubnetRule 403 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
'500':
description: Internal server error.
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
examples:
CreateSubnetRule500Example:
summary: Default createSubnetRule 500 response
x-microcks-default: true
value:
error: example-error
message: Security firewall network configured traffic blocked threat.
request_id: 709c60bb-8234-4bc4-938b-d0835224c350
x-microcks-operation:
delay: 0
dispatcher: FALLBACK
components:
schemas:
SubnetRuleRequest:
type: object
required:
- name
- subnet
- group_id
properties:
name:
type: string
description: Display name for the subnet rule.
example: Production Firewall 11
subnet:
type: string
description: CIDR notation subnet this rule covers.
example: 10.175.38.0/24
group_id:
type: string
description: Connector group to use for routing traffic to this subnet.
example: '115097'
enabled:
type: boolean
default: true
example: true
SubnetRule:
type: object
properties:
rule_id:
type: string
description: Unique identifier of the subnet rule.
example: '373292'
name:
type: string
description: Display name of the rule.
example: Corporate Firewall 37
subnet:
type: string
description: CIDR notation subnet this rule covers (e.g., 10.0.0.0/8).
example: 10.131.182.0/24
group_id:
type: string
description: Connector group used to route traffic to this subnet.
example: '527569'
enabled:
type: boolean
description: Whether this rule is active.
example: false
created_at:
type: string
format: date-time
example: '2025-04-09T20:01:23Z'
ErrorResponse:
type: object
properties:
error:
type: string
description: Error code identifying the error type.
example: example-error
message:
type: string
description: Human-readable description of the error.
example: Security firewall network configured traffic blocked threat.
request_id:
type: string
description: Request identifier for support correlation.
example: 709c60bb-8234-4bc4-938b-d0835224c350
securitySchemes:
oauth2Bearer:
type: http
scheme: bearer
bearerFormat: JWT
description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.