Palo Alto Networks Target API
Operations for managing scan targets (create, update, delete, list).
Operations for managing scan targets (create, update, delete, list).
openapi: 3.2.0
info:
title: Prisma AIRS Red Teaming Management Target API
description: Red Teaming Management API - Configure and manage security groups and rules for AI/ML model scanning. © 2025 Palo Alto Networks, Inc
version: 0.7.67
termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
license:
name: MIT
url: https://opensource.org/license/mit
contact:
email: support@paloaltonetworks.com
name: Palo Alto Networks Technical Support
url: https://support.paloaltonetworks.com
servers:
- url: https://api.sase.paloaltonetworks.com/ai-red-teaming/mgmt-plane
security:
- bearerAuth: []
tags:
- name: Target
description: Operations for managing scan targets (create, update, delete, list).
paths:
/v1/target:
post:
tags:
- Target
summary: Create target
description: Create a new scan target.
operationId: create_target_v1_target_post
parameters:
- name: validate
in: query
required: false
schema:
type: boolean
description: Whether to validate target configuration
examples:
- true
title: Validate
description: Whether to validate target configuration
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/TargetCreateRequestSchema'
responses:
201:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/TargetResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
get:
tags:
- Target
summary: List targets
description: List all scan targets with pagination and filtering support.
operationId: list_targets_v1_target_get
parameters:
- name: skip
in: query
required: false
schema:
type: integer
minimum: 0
description: Number of records to skip
default: 0
title: Skip
description: Number of records to skip
- name: limit
in: query
required: false
schema:
type: integer
maximum: 100
minimum: 1
description: Maximum records to return
default: 10
title: Limit
description: Maximum records to return
- name: target_type
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/TargetType'
- type: 'null'
description: Filter by target type
title: Target Type
description: Filter by target type
- name: status
in: query
required: false
schema:
anyOf:
- $ref: '#/components/schemas/TargetStatusFilter'
- type: 'null'
description: Filter by target status or profiling status
title: Status
description: Filter by target status or profiling status
- name: search
in: query
required: false
schema:
anyOf:
- type: string
- type: 'null'
description: Search target by name
title: Search
description: Search target by name
- name: adapter_uuid
in: query
required: false
schema:
anyOf:
- type: string
format: uuid
- type: 'null'
description: Filter targets by the custom adapter they use
title: Adapter Uuid
description: Filter targets by the custom adapter they use
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/TargetListSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
/v1/target/{target_uuid}:
get:
tags:
- Target
summary: Get target details
description: Retrieve a specific target by UUID with complete configuration details and masked connection parameters.
operationId: get_target_v1_target__target_uuid__get
parameters:
- name: target_uuid
in: path
required: true
schema:
type: string
format: uuid
title: Target Uuid
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/TargetRedactSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
put:
tags:
- Target
summary: Update target
description: Update an existing target with new configuration and optional validation control.
operationId: update_target_v1_target__target_uuid__put
parameters:
- name: target_uuid
in: path
required: true
schema:
type: string
format: uuid
title: Target Uuid
- name: validate
in: query
required: false
schema:
type: boolean
description: Whether to validate target configuration
default: true
title: Validate
description: Whether to validate target configuration
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/TargetUpdateRequestSchema'
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/TargetSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
delete:
tags:
- Target
summary: Delete target
description: Permanently delete a target and its encrypted configuration data.
operationId: delete_target_v1_target__target_uuid__delete
parameters:
- name: target_uuid
in: path
required: true
schema:
type: string
format: uuid
title: Target Uuid
responses:
204:
description: Successful Response
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
/v1/target/{target_uuid}/profile:
post:
tags:
- Target
summary: Start target profiling
description: Manually trigger target profiling. Target must be active with industry and use_case.
operationId: start_profiling_v1_target__target_uuid__profile_post
parameters:
- name: target_uuid
in: path
required: true
schema:
type: string
format: uuid
title: Target Uuid
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/StartProfilingResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
put:
tags:
- Target
summary: Update target profile
description: Update target background and additional context fields without connection validation.
operationId: update_target_profile_v1_target__target_uuid__profile_put
parameters:
- name: target_uuid
in: path
required: true
schema:
type: string
format: uuid
title: Target Uuid
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/TargetContextUpdateSchema'
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/TargetSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
get:
tags:
- Target
summary: Get profiling results
description: Get profiling results including merged user and profiler data.
operationId: get_profiling_results_v1_target__target_uuid__profile_get
parameters:
- name: target_uuid
in: path
required: true
schema:
type: string
format: uuid
title: Target Uuid
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/TargetProfileResponse'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
/v1/target/probe:
post:
tags:
- Target
summary: Run profiling probes on target
description: Send profiling questions to a target using provided connection parameters. Returns TargetResponseSchema with target_background and additional_context populated from probe responses.
operationId: run_target_probes_v1_target_probe_post
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/TargetProbeRequest'
required: true
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/TargetResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
/v1/target/validate-auth:
post:
tags:
- Target
summary: Validate authentication configuration
description: Validate OAuth2 credentials by fetching a test token. For HEADERS and BASIC_AUTH, validates field presence only.
operationId: validate_auth_v1_target_validate_auth_post
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/TargetAuthValidationRequestSchema'
required: true
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/TargetAuthValidationResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
/v1/target/ms-copilot-studio/auth-url:
post:
tags:
- Target
summary: Generate Copilot Studio auth URL
description: Generate MS Copilot Studio OAuth authorization URL.
operationId: generate_ms_copilot_studio_auth_url_v1_target_ms_copilot_studio_auth_url_post
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MSCopilotStudioAuthUrlRequestSchema'
required: true
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/MSCopilotStudioAuthUrlResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
/v1/target/ms-copilot-studio/token:
post:
tags:
- Target
summary: Exchange Copilot Studio auth code
description: Exchange auth code for tokens via MSAL, store token cache in GSM.
operationId: exchange_ms_copilot_studio_token_v1_target_ms_copilot_studio_token_post
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MSCopilotStudioTokenRequestSchema'
required: true
responses:
200:
description: Successful Response
content:
application/json:
schema:
$ref: '#/components/schemas/MSCopilotStudioTokenResponseSchema'
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
/v1/target/ms-copilot-studio/token/{token_json_uuid}:
delete:
tags:
- Target
summary: Delete MS Copilot Studio token records
description: Delete both auth flow and token cache GSM records (cancel cleanup).
operationId: delete_ms_copilot_studio_token_v1_target_ms_copilot_studio_token__token_json_uuid__delete
parameters:
- name: token_json_uuid
in: path
required: true
schema:
type: string
format: uuid
title: Token Json Uuid
responses:
204:
description: Successful Response
422:
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
components:
schemas:
DatabricksConnectionRedactParams:
properties:
auth_type:
$ref: '#/components/schemas/red_team_shared__schemas__databricks__AuthType'
description: Auth type
access_token:
anyOf:
- type: string
format: password
writeOnly: true
- type: 'null'
title: Access Token
description: Databricks access token
client_id:
anyOf:
- type: string
- type: 'null'
title: Client Id
description: Databricks client_id
secret:
anyOf:
- type: string
format: password
writeOnly: true
- type: 'null'
title: Secret
description: Databricks secret
workspace_url:
type: string
title: Workspace Url
description: Databricks workscpace_url
model_name:
type: string
title: Model Name
description: Databricks model name
type: object
required:
- auth_type
- workspace_url
- model_name
title: DatabricksConnectionRedactParams
RestConnectionParamsRedactBase:
properties:
api_endpoint:
anyOf:
- type: string
- type: 'null'
title: Api Endpoint
description: API endpoint URL
examples:
- https://api.openai.com/v1/responses
request_headers:
additionalProperties: true
type: object
title: Request Headers
description: Request headers
default: {}
examples:
- Authorization: Bearer sk-xxx
Content-Type: application/json
request_json:
additionalProperties: true
type: object
title: Request Json
description: Request JSON
default: {}
examples:
- input:
- content:
- text: '{INPUT}'
type: input_text
role: user
model: gpt-4.1-nano
response_json:
additionalProperties: true
type: object
title: Response Json
description: Response JSON
default: {}
examples:
- content: '{RESPONSE}'
response_key:
type: string
title: Response Key
description: Response key
default: null
examples:
- content
target_connection_config:
anyOf:
- $ref: '#/components/schemas/OpenAIConnectionRedactParams'
- $ref: '#/components/schemas/HuggingfaceConnectionRedactParams'
- $ref: '#/components/schemas/DatabricksConnectionRedactParams'
- $ref: '#/components/schemas/BedrockAccessConnectionRedactParams'
- $ref: '#/components/schemas/MSCopilotStudioConnectionRedactParams'
- type: 'null'
title: Target Connection Config
description: Target Connection config of type openai/huggingface ..
curl:
anyOf:
- type: string
- type: 'null'
title: Curl
description: Generated cURL command ready to use (redacted for security)
examples:
- 'curl "https://api.openai.com/v1/chat/completions" -H "Content-Type: application/json" -H "Authorization: Bearer ***" -d ''{"model":"gpt-4","messages":[{"role":"user","content":"{INPUT}"}]}'''
multi_turn_config:
anyOf:
- oneOf:
- $ref: '#/components/schemas/MultiTurnStatefulConfig'
- $ref: '#/components/schemas/MultiTurnStatelessConfig'
discriminator:
propertyName: type
mapping:
stateful: '#/components/schemas/MultiTurnStatefulConfig'
stateless: '#/components/schemas/MultiTurnStatelessConfig'
- type: 'null'
title: Multi Turn Config
description: Multi turn config for stateful or stateless target
examples:
- 'assistant_role: assistant'
type: object
title: RestConnectionParamsRedactBase
HeadersAuthConfig:
properties:
auth_header:
additionalProperties:
type: string
type: object
title: Auth Header
description: 'Auth header as {name: value} dict'
examples:
- Authorization: Bearer sk-xxxxxxxxxxxx
- x-api-key: my-api-key
type: object
required:
- auth_header
title: HeadersAuthConfig
description: Static header injection (API keys, bearer tokens).
TargetType:
type: string
enum:
- APPLICATION
- AGENT
- MODEL
title: TargetType
description: Target Types Available
HuggingfaceConnectionRedactParams:
properties:
api_key:
type: string
format: password
title: Api Key
description: Huggingface API key for authentication
writeOnly: true
examples:
- sk-abxx
model_name:
type: string
title: Model Name
description: Huggingface model name for API requests
examples:
- gpt-4.1-nano
type: object
required:
- api_key
- model_name
title: HuggingfaceConnectionRedactParams
description: Connection parameters specific to huggingface targets
BedrockAccessConnectionParams:
properties:
access_id:
type: string
title: Access Id
description: AWS access key ID
access_secret:
type: string
title: Access Secret
description: AWS secret access key
session_token:
anyOf:
- type: string
- type: 'null'
title: Session Token
description: AWS session token (optional)
region:
type: string
title: Region
description: AWS region
model_id:
type: string
title: Model Id
description: Bedrock model ID
type: object
required:
- access_id
- access_secret
- region
- model_id
title: BedrockAccessConnectionParams
description: AWS Bedrock access parameters stored in target_metadata.
MSCopilotStudioAuthUrlResponseSchema:
properties:
auth_url:
type: string
title: Auth Url
description: OAuth authorization URL for user login
token_json_uuid:
type: string
format: uuid
title: Token Json Uuid
description: UUID referencing MSAL token cache in GSM
state:
type: string
title: State
description: MSAL-generated state for frontend session tracking (correlate auth callback with original request)
type: object
required:
- auth_url
- token_json_uuid
- state
title: MSCopilotStudioAuthUrlResponseSchema
description: Response containing the generated OAuth auth URL.
PaginationSchema:
properties:
total_items:
anyOf:
- type: integer
- type: 'null'
title: Total Items
type: object
title: PaginationSchema
MultiTurnStatelessConfig:
properties:
type:
type: string
const: stateless
title: Type
default: stateless
assistant_role:
anyOf:
- type: string
- type: 'null'
title: Assistant Role
description: Role name for assistant messages in conversation history (e.g., 'assistant', 'bot', 'model')
examples:
- assistant
- bot
- model
- ai
type: object
title: MultiTurnStatelessConfig
description: 'Configuration for stateless multi-turn targets (session_supported=false).
Stateless targets require the client to maintain and send conversation history.
The assistant_role specifies the role name used for assistant messages in the history.
'
StreamingConnectionParamsBase-Output:
properties:
api_endpoint:
anyOf:
- type: string
- type: 'null'
title: Api Endpoint
description: API endpoint URL
examples:
- https://api.openai.com/v1/responses
request_headers:
additionalProperties: true
type: object
title: Request Headers
description: Request headers
default: {}
examples:
- Authorization: Bearer sk-xxx
Content-Type: application/json
request_json:
additionalProperties: true
type: object
title: Request Json
description: Request JSON
default: {}
examples:
- input:
- content:
- text: '{INPUT}'
type: input_text
role: user
model: gpt-4.1-nano
response_json:
additionalProperties: true
type: object
title: Response Json
description: Response JSON
default: {}
examples:
- content: '{RESPONSE}'
response_key:
type: string
title: Response Key
description: Response key
default: null
examples:
- content
target_connection_config:
anyOf:
- $ref: '#/components/schemas/OpenAIConnectionParams'
- $ref: '#/components/schemas/HuggingfaceConnectionParams'
- $ref: '#/components/schemas/DatabricksConnectionParams'
- $ref: '#/components/schemas/BedrockAccessConnectionParams'
- $ref: '#/components/schemas/MSCopilotStudioConnectionParams'
- type: 'null'
title: Target Connection Config
description: Target Connection config of type openai/huggingface ..
curl:
anyOf:
- type: string
- type: 'null'
title: Curl
description: Generated cURL command ready to use (redacted for security)
examples:
- 'curl "https://api.openai.com/v1/chat/completions" -H "Content-Type: application/json" -H "Authorization: Bearer ***" -d ''{"model":"gpt-4","messages":[{"role":"user","content":"{INPUT}"}]}'''
multi_turn_config:
anyOf:
- oneOf:
- $ref: '#/components/schemas/MultiTurnStatefulConfig'
- $ref: '#/components/schemas/MultiTurnStatelessConfig'
discriminator:
propertyName: type
mapping:
stateful: '#/components/schemas/MultiTurnStatefulConfig'
stateless: '#/components/schemas/MultiTurnStatelessConfig'
- type: 'null'
title: Multi Turn Config
description: Multi turn config for stateful or stateless target
examples:
- 'assistant_role: assistant'
response_stop_key:
type: string
title: Response Stop Key
response_stop_value:
type: string
title: Response Stop Value
type: object
required:
- response_stop_key
- response_stop_value
title: StreamingConnectionParamsBase
description: Base streaming connection parameters without generated fields.
ResponseMode:
type: string
enum:
- REST
- STREAMING
- WEBSOCKET
- WEBSOCKET_STREAMING
title: ResponseMode
description: Response mode for target interactions.
BasicAuthAuthConfigRedact:
properties:
basic_auth_location:
$ref: '#/components/schemas/BasicAuthLocation'
description: 'Where credentials are sent: HEADER or PAYLOAD'
default: HEADER
basic_auth_header:
anyOf:
- additionalProperties:
type: string
type: object
- type: 'null'
title: Basic Auth Header
description: 'Auth header as {name: value} dict (required when location=HEADER)'
examples:
- Authorization: Basic dXNlcjpwYXNz
type: object
title: BasicAuthAuthConfigRedact
HuggingfaceConnectionParams:
properties:
api_key:
type: string
title: Api Key
description: Huggingface API key for authentication
examples:
- sk-abxx
model_name:
type: string
title: Model Name
description: Huggingface model name for API requests
examples:
- gpt-4.1-nano
type: object
required:
- api_key
- model_name
title: HuggingfaceConnectionParams
description: Connection parameters specific to huggingface targets
OpenAIConnectionParams:
properties:
api_key:
type: string
title: Api Key
description: OpenAI API key for authentication
examples:
- sk-abxx
model_name:
type: string
title: Model Name
description: OpenAI model name for API requests
examples:
- gpt-4.1-nano
type: object
required:
- api_key
- model_name
title: OpenAIConnectionParams
description: Connection parameters specific to OpenAI targets
AdapterVarBase:
properties:
key:
type: string
maxLength: 255
title: Key
description: Variable key
value:
anyOf:
- type: string
- type: 'null'
title: Value
description: Variable value. On update, null means 'keep the existing value' — used for unchanged secrets, whose values are never returned.
type:
$ref: '#/components/schemas/AdapterVarType'
description: VAR (non-sensitive) or SECRET (sensitive)
type: object
required:
- key
- type
title: AdapterVarBase
description: A single adapter configuration variable (also the GSM-stored shape).
BasicAuthLocation:
type: string
enum:
- HEADER
- PAYLOAD
title: BasicAuthLocation
description: Where Basic Auth credentials are sent.
NativeConnectionParamsBase-Output:
properties:
target_connection_config:
anyOf:
- $ref: '#/components/schemas/OpenAIConnectionParams'
- $ref: '#/components/schemas/HuggingfaceConnectionParams'
- $ref: '#/components/schemas/DatabricksConnectionParams'
- $ref: '#/components/schemas/BedrockAccessConnectionParams'
- $ref: '#/components/schemas/MSCopilotStudioConnectionParams'
- type: 'null'
title: Target Connection Config
description: Provider-specific connection config
multi_turn_config:
anyOf:
- oneOf:
- $ref: '#/components/schemas/MultiTurnStatefulConfig'
- $ref: '#/components/schemas/MultiTurnStatelessConfig'
discriminator:
propertyName: type
mapping:
stateful: '#/components/schemas/MultiTurnStatefulConfig'
stateless: '#/components/schemas/MultiTurnStatelessConfig'
- type: 'null'
title: Multi Turn Config
description: Multi-turn config for stateful or stateless target
multi_turn_supported:
type: boolean
title: Multi Turn Supported
description: Whether a native target that drives multi-turn internally supports it. Currently consumed only by custom target adapters, which have no multi_turn_config to infer it from; gates the multi-turn validation probe.
default: false
type: object
title: NativeConnectionParamsBase
description: 'Base connection parameters for native/SDK-based targets (no HTTP endpoint).
Used for no-code agent platforms like Microsoft Copilot Studio where
interaction is via a provider''s client library, not HTTP REST/streaming.
# TODO: Consider refactoring RestConnectionParamsBase and StreamingConnectionParamsBase
# to share a common base with this class (e.g., extract target_connection_config and
# multi_turn_config into a shared parent).
'
MSCopilotStudioTokenRequestSchema:
properties:
auth_response:
additionalProperties:
type: string
type: object
title: Auth Response
description: Full redirect query params from Microsoft (code, state, session_state, etc.)
token_json_uuid:
type: string
format: uuid
title: Token Json Uuid
description: UUID from POST /auth-url response
client_id:
type: string
title: Client Id
description: Azure App Registration Client ID
client_secret:
type: string
title: Client Secret
description: Azure App Registration Client Secret
tenant_id:
type: string
title: Tenant Id
description: Azure AD Tenant ID
target_uuid:
anyOf:
- type: string
format: uuid
- type: 'null'
title: Target Uuid
description: Existing target UUID for resolving redacted client_secret on re-auth.
additionalProperties: false
type: object
required:
- auth_response
- token_json_uuid
- client_id
- client_secret
- tenant_id
title: MSCopilotStudioTokenRequestSchema
description: Request body for exchanging auth code for tokens (POST /token).
StreamingConnectionParamsRedactBase:
properties:
api_endpoint:
anyOf:
- type: string
- type: 'null'
title: Api Endpoint
description: API endpoint URL
examples:
- https://api.openai.com/v1/responses
request_headers:
additionalProperties: true
type: object
title: Request Headers
description: Request headers
default: {}
examples:
- Authorization: Bearer sk-xxx
Content-Type: application/json
request_json:
additionalProperties: true
type: object
title: Request Json
description: Request JSON
default: {}
examples:
- input:
- content:
- text: '{INPUT}'
type: input_text
role: user
# --- truncated at 32 KB (135 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-target-api-openapi.yml