OpenAPI Specification
openapi: 3.2.0
info:
contact:
email: support@paloaltonetworks.com
description: 'The Open API specification file represents the APIs available for Prisma Access Insights 3.0.
The Prisma Access Insights 3.0 APIs allow you to query your Prisma Access tenant for the health of
your Prisma Access network deployment. The 3.0 APIs are intended for cloud-managed Prisma Access
customers, where the tenants have been onboarded by Palo Alto Networks using a Tenant Service Group
(TSG) identifier.
These APIs use the common SASE authentication mechanism and base URL. See the
[Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information.
This Open API spec file was created on May 30, 2025. To check for a more recent version of this file, see
[Prisma Insights APIs on pan.dev](https://pan.dev//access/api/insights/).
© 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo
Alto Networks. A list of our trademarks can be found at
[https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html)
All other marks mentioned herein may be trademarks of their respective companies.
'
license:
name: MIT
url: https://opensource.org/license/mit
termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
title: Palo Alto Networks 3.0 Users API API
version: '3.0'
servers:
- url: https://api.sase.paloaltonetworks.com
tags:
- description: 'Users API
'
name: Users API
paths:
/insights/v3.0/resource/query/users/agent/connected_user_count:
post:
description: 'Retrieve the number of connected agent users.
'
operationId: post-insights-v3.0-resource-query-users-agent-connected_user_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: connect_method
values:
- AGENT
- AGENT_PROXY
- operator: in
property: application_name
values:
- salesforce
- operator: in
property: edge_location_display_name
values:
- US West
- operator: in
property: fw_name
values:
- vmseries
- operator: in
property: source_country_name
values:
- US
- operator: in
property: source_city_name
values:
- San Jose
- operator: in
property: username
values:
- john.doe
- operator: in
property: domain_name
values:
- salesforce.com
schema:
properties:
filter:
properties:
rules:
items:
properties:
application_name:
description: Name of the application.
example: salesforce
type: string
connect_method:
description: Method of connection.
example: AGENT
type: string
domain_name:
description: Application domain name.
example: salesforce.com
type: string
edge_location_display_name:
description: Name of the PA location.
example: US West
type: string
event_time:
description: Time of the event.
example: 5
type: number
fw_name:
description: Name of the firewall.
example: vmseries
type: string
platform_type:
description: Type of platform.
example: prisma_access
type: string
source_city_name:
description: Name of the source city.
example: San Jose
type: string
source_country_name:
description: Name of the source country.
example: US
type: string
username:
description: Username.
example: john.doe
type: string
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
user_count:
description: Count of connected users.
example: 18669
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Agent Connected Users Data
tags:
- Users API
/insights/v3.0/resource/query/users/agentless/connected_user_count:
post:
description: 'Retrieve the number of connected agentless proxy users.
'
operationId: post-insights-v3.0-resource-query-users-agentless-connected_user_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: connection_method
values:
- AGENTLESS
- operator: in
property: application_name
values:
- salesforce
- operator: in
property: edge_location_display_name
values:
- US West
- operator: in
property: fw_name
values:
- vmseries
- operator: in
property: source_country_name
values:
- US
- operator: in
property: source_city_name
values:
- San Jose
- operator: in
property: username
values:
- john.doe
- operator: in
property: domain_name
values:
- salesforce.com
schema:
properties:
filter:
properties:
rules:
items:
properties:
application_name:
description: Application name.
example: zoom
type: string
connection_method:
description: Connection method used by the user.
example: AGENTLESS
type: string
device_score:
description: Device score.
example: 3
type: number
edge_location_display_name:
description: Prisma Access Location.
example: US West
type: string
event_time:
description: Time of the event.
example: 5
type: number
experience_score:
description: User experience score.
example: 4
type: number
geoip_from_city_name:
description: City from GeoIP.
example: San Jose
type: string
geoip_from_country_name:
description: Country from GeoIP.
example: US
type: string
instance_name:
description: Instance name.
example: instance1
type: string
internet_score:
description: Internet score.
example: 3
type: number
lan_score:
description: LAN score.
example: 5
type: number
pa_score:
description: Prisma Access score.
example: 5
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
source_user_info_name:
description: Source user name.
example: john.doe
type: string
wifi_score:
description: Wifi score.
example: 4
type: number
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
user_count:
description: Count of connected users.
example: 15669
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Agentless Connected User Data
tags:
- Users API
/insights/v3.0/resource/query/users/all/user_list_all:
post:
description: Retrieves a list of users with detailed information.
operationId: post-insights-v3.0-resource-query-users-all-user_list_all
parameters:
- description: Region mapping for the tenant.
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation.
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: connection_method
values:
- Agent
- operator: gt
property: experience_score
values:
- 70
- operator: gt
property: device_score
values:
- 80
- operator: gt
property: lan_score
values:
- 90
- operator: gt
property: wifi_score
values:
- 85
- operator: gt
property: pa_score
values:
- 75
- operator: gt
property: internet_score
values:
- 95
- operator: in
property: pa_location_name
values:
- US West
- operator: in
property: edge_location_display_name
values:
- US East
- operator: in
property: instance_name
values:
- PA-VM
- operator: in
property: source_country
values:
- US
- operator: in
property: source_city
values:
- San Jose
- operator: in
property: application_name
values:
- Salesforce
- operator: in
property: rbi
values:
- Enabled
- operator: in
property: username
values:
- john.doe
- operator: in
property: domain_name
values:
- salesforce.com
schema:
properties:
filter:
properties:
rules:
items:
properties:
application_name:
description: Application.
example: Salesforce
type: string
connection_method:
description: Device connection method.
example: Agent
type: string
device_score:
description: Device score.
example: 80
type: number
domain_name:
description: Application domain name.
example: salesforce.com
type: string
edge_location_display_name:
description: Edge location display name.
example: US East
type: string
event_time:
description: Time of the event.
example: 5
type: number
experience_score:
description: Experience score.
example: 70
type: number
instance_name:
description: Firewall name.
example: PA-VM
type: string
internet_score:
description: Internet score.
example: 95
type: number
lan_score:
description: LAN score.
example: 90
type: number
pa_score:
description: Prisma Access score.
example: 75
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
rbi:
description: RBI status.
example: Enabled
type: string
source_city_name:
description: Source city name.
example: San Jose
type: string
source_country_name:
description: Source country name.
example: US
type: string
username:
description: Username.
example: john.doe
type: string
wifi_score:
description: WiFi score.
example: 85
type: number
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
adem_username:
description: ADEM Username.
example: john.doe@example.com
type: string
agent_uuid:
description: Agent UUID.
example: a1b2c3d4-e5f6-7890-1234-567890abcdef
type: string
application_count:
description: Application count.
example: 10
type: integer
connection_method:
description: Connection method.
example: Agent
type: string
device_name:
description: Device name.
example: Device - 10.01.00.00
type: string
device_score_value:
description: Device score value.
example: 80
type: integer
experience_score_value:
description: Experience score value.
example: 70
type: integer
internet_score_value:
description: Internet score value.
example: 95
type: integer
lan_score_value:
description: LAN score value.
example: 90
type: integer
last_activity_timestamp_epoc_millis:
description: Last activity timestamp in epoch milliseconds.
example: 1678886400000
type: integer
pa_fw_location:
description: Prisma Access firewall location.
example: sfc-cor-cf000
type: string
pa_score_value:
description: Prisma Access score value.
example: 75
type: integer
source_city:
description: Source city.
example: San Jose
type: string
source_country:
description: Source country.
example: US
type: string
threat_count:
description: Threat count.
example: 5
type: integer
total_bytes:
description: Total bytes transferred.
example: 1000000
type: integer
username:
description: Username.
example: john.doe
type: string
wifi_score_value:
description: WiFi score value.
example: 85
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Get User List
tags:
- Users API
/insights/v3.0/resource/query/users/branch/connected_user_count:
post:
description: 'Retrieve the number of branch connected users.
'
operationId: post-insights-v3.0-resource-query-users-branch-connected_user_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: header
name: Prisma-Tenant
required: false
schema:
example: 12345678:12345679
type: string
requestBody:
content:
application/json:
examples:
With mandatory filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
With possible filters:
value:
filter:
rules:
- operator: last_n_hours
property: event_time
values:
- 5
- operator: in
property: platform_type
values:
- prisma_access
- ngfw
- operator: in
property: connection_method
values:
- BRANCH
- operator: gt
property: experience_score
values:
- 70
- operator: gt
property: device_score
values:
- 80
- operator: gt
property: lan_score
values:
- 60
- operator: gt
property: wifi_score
values:
- 70
- operator: gt
property: pa_score
values:
- 80
- operator: gt
property: internet_score
values:
- 50
- operator: in
property: edge_location_display_name
values:
- US West
- operator: in
property: instance_name
values:
- fw00
- operator: in
property: source_country
values:
- US
- operator: in
property: source_city
values:
- San Jose
- operator: in
property: username
values:
- john.doe
- operator: in
property: domain_name
values:
- salesforce.com
schema:
properties:
filter:
properties:
rules:
items:
properties:
connection_method:
description: Method of connection.
example: BRANCH
type: string
device_score:
description: Device score.
example: 90
type: number
domain_name:
description: Application domain name.
example: salesforce.com
type: string
edge_location_display_name:
description: Name of the PA location.
example: US West
type: string
event_time:
description: Time of the event.
example: 5
type: number
experience_score:
description: Experience score.
example: 80
type: number
instance_name:
description: Name of the firewall.
example: fw00
type: string
internet_score:
description: Internet score.
example: 70
type: number
lan_score:
description: LAN score.
example: 75
type: number
pa_score:
description: Prisma Access score.
example: 95
type: number
platform_type:
description: Type of platform.
example: prisma_access
type: string
source_city:
description: Name of the source city.
example: San Jose
type: string
source_country:
description: Name of the source country.
example: US
type: string
username:
description: Username.
example: john.doe
type: string
wifi_score:
description: WiFi score.
example: 85
type: number
type: object
required:
- event_time
type: array
type: object
type: object
required: true
responses:
'200':
content:
application/json:
schema:
properties:
user_count:
description: Count of users.
example: 19399
type: integer
type: object
description: OK
'400':
description: Resource property is not valid
'403':
description: Permission Denied
'404':
description: Resource not found
'500':
description: Failed to process request
security:
- Bearer: []
summary: Branch Connected Users Data
tags:
- Users API
/insights/v3.0/resource/query/users/eb/connected_user_count:
post:
description: 'Retrieve the number of users connected through Enterprise Browser.
'
operationId: post-insights-v3.0-resource-query-users-eb-connected_user_count
parameters:
- description: 'Map the region for the tenant.
'
in: header
name: X-PANW-Region
required: true
schema:
example: americas
type: string
- description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.
'
in: head
# --- truncated at 32 KB (44 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-users-api-api-openapi.yml