Palo Alto Networks Users API

openapi: 3.2.0
info:
  title: Palo Alto Networks Users API
  x-refined-note:
  - x-description-source differs across the merged source definitions and was not carried
  version: '1.0'
  description: 'Operations tagged Users across 8 of this provider''s published API definitions: palo-alto-access-browser-mgmt-prismaaccess-browser-management-latest-openapi.yaml, palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json, palo-alto-cwpp-34-03-openapi-34-03-138-saas-openapi.json, palo-alto-cwpp-openapi-34-04-145-saas-openapi.json, palo-alto-networks-users-api-openapi.yml, palo-alto-prisma-access-browser-api-openapi-original.yml, palo-alto-saas-security-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: PATH_TO_CONSOLE
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
- url: https://api.sase.paloaltonetworks.com/browser-mgmt
  description: SASE Prisma Access Browser Management API production server.
- url: https://api.aperture.paloaltonetworks.com
  description: SaaS Security (Aperture) API production server.
tags:
- name: Users
paths:
  /seb-api/v1/users:
    get:
      summary: Returns a list of users
      description: Retrieve the users details through this Application Programming Interface endpoint.
      operationId: GetSeb-apiV1Users
      responses:
        '200':
          description: A list of users with pagination info
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/User'
        '400':
          description: Bad request
        '500':
          description: Internal server error
      parameters:
      - name: limit
        in: query
        description: Number of users to return
        required: false
        schema:
          type: integer
          format: int32
      - name: includeDeleted
        in: query
        description: Include deleted users
        required: false
        schema:
          type: boolean
      - name: user.name
        in: query
        description: Filter by user name
        required: false
        schema:
          type: string
      - name: user.email
        in: query
        description: Filter by user email
        required: false
        schema:
          type: string
      - name: user.first_seen_gte
        in: query
        description: Filter by first seen time or after
        required: false
        schema:
          type: string
          format: date-time
      - name: user.last_seen_lte
        in: query
        description: Filter by last seen time or before
        required: false
        schema:
          type: string
          format: date-time
      - name: user.status
        in: query
        description: Filter by user status
        required: false
        schema:
          $ref: '#/components/schemas/UserStatus'
      - name: cursor
        in: query
        description: An optional opaque string that defines from where to start listing
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: The field to sort by
        required: false
        schema:
          type: string
          enum:
          - user.name
          - user.email
          - user.first_seen
          - user.last_seen
          - user.status
      - name: order
        in: query
        description: The sort order
        required: false
        schema:
          $ref: '#/components/schemas/Order'
      tags:
      - Users
      security:
      - BearerAuth: []
  /seb-api/v1/users/{id}:
    get:
      summary: Returns a user by ID
      description: Retrieve the {id} details through this Application Programming Interface endpoint.
      operationId: GetSeb-apiV1Usersbyid
      responses:
        '200':
          description: A user
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '404':
          description: User not found
      parameters:
      - name: id
        in: path
        description: User ID
        required: true
        schema:
          type: string
      tags:
      - Users
      security:
      - BearerAuth: []
  /seb-api/v1/users/suspend:
    post:
      summary: Suspend users
      description: Suspend one or more users by changing their status to suspended. Suspended users will lose access to the browser from all of their known or future devices, except from their Prisma Browser Extension and mobile devices.
      operationId: PostSeb-apiV1UsersSuspend
      responses:
        '200':
          description: Users suspended successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserSuspendResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: One or more users not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Users
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserStatusChangeRequest'
      security:
      - BearerAuth: []
  /seb-api/v1/users/resume:
    post:
      summary: Resume suspended users
      description: Resume one or more suspended users by changing their status to active. Resumed users will regain access to the browser from all of their known or future devices.
      operationId: PostSeb-apiV1UsersResume
      responses:
        '200':
          description: Users resumed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserResumeResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: One or more users not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Users
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserStatusChangeRequest'
      security:
      - BearerAuth: []
  /seb-api/v1/users/force-reauth:
    post:
      summary: Force re-authentication for users
      description: Force re-authentication on all active devices for one or more users. Upon execution, targeted users will be required to re-authenticate to the browser on all of their devices.
      operationId: PostSeb-apiV1UsersForce-reauth
      responses:
        '200':
          description: Force re-authentication initiated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserForceReauthResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: One or more users not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
      parameters: []
      tags:
      - Users
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserStatusChangeRequest'
      security:
      - BearerAuth: []
  /api/v34.03/users:
    get:
      description: 'Get Users. GET /api/v34.03/users on the Users API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.UserList'
          description: UserList represents a list of users
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: userManagement
      operationId: get-users
      summary: Get Users
      x-description-source: desc/users/get.md
    post:
      description: 'Add Users. POST /api/v34.03/users on the Users API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api.User'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: userManagement
      operationId: post-users
      summary: Add Users
      x-description-source: desc/users/post.md
    put:
      description: 'Update Users. PUT /api/v34.03/users on the Users API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api.User'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: userManagement
      operationId: put-users
      summary: Update Users
      x-description-source: desc/users/put.md
  /api/v34.03/users/password:
    put:
      description: 'Update User Password. PUT /api/v34.03/users/password on the Users API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/types.UserPassword'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: user
      operationId: put-users-password
      summary: Update User Password
      x-description-source: desc/users/password_put.md
  /api/v34.03/users/{id}:
    delete:
      description: 'Delete Users. DELETE /api/v34.03/users/{id} on the Users API. Takes 1 path parameter. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: userManagement
      operationId: delete-users-id
      summary: Delete Users
      x-description-source: desc/users/id_delete.md
  /api/v34.04/users:
    get:
      description: 'Get Users. GET /api/v34.04/users on the Users API. Documented responses: 200.'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/api.UserList'
          description: UserList represents a list of users
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: userManagement
      operationId: get-users
      summary: Get Users
      x-description-source: desc/users/get.md
    post:
      description: 'Add Users. POST /api/v34.04/users on the Users API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api.User'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: userManagement
      operationId: post-users
      summary: Add Users
      x-description-source: desc/users/post.md
    put:
      description: 'Update Users. PUT /api/v34.04/users on the Users API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/api.User'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: userManagement
      operationId: put-users
      summary: Update Users
      x-description-source: desc/users/put.md
  /api/v34.04/users/password:
    put:
      description: 'Update User Password. PUT /api/v34.04/users/password on the Users API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/types.UserPassword'
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: user
      operationId: put-users-password
      summary: Update User Password
      x-description-source: desc/users/password_put.md
  /api/v34.04/users/{id}:
    delete:
      description: 'Delete Users. DELETE /api/v34.04/users/{id} on the Users API. Takes 1 path parameter. Documented responses: 200.'
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
        default:
          description: ''
      tags:
      - Users
      x-prisma-cloud-target-env:
        permission: userManagement
      operationId: delete-users-id
      summary: Delete Users
      x-description-source: desc/users/id_delete.md
  /v1/users:
    get:
      operationId: listBrowserUsers
      summary: Palo Alto Networks List Browser Users
      description: Returns the list of users enrolled in the Prisma Access Browser. Includes user identity information, assigned policy, and current active session count.
      tags:
      - Users
      parameters:
      - name: policy_id
        in: query
        description: Filter users by assigned browser policy.
        schema:
          type: string
        example: '645121'
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of users to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Browser users returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/BrowserUser'
              examples:
                ListBrowserUsers200Example:
                  summary: Default listBrowserUsers 200 response
                  x-microcks-default: true
                  value:
                    total: 828
                    offset: 606
                    limit: 36
                    items:
                    - user_id: '519106'
                      email: jane.doe@example.com
                      display_name: Carlos Doe
                      policy_id: '550297'
                      active_sessions: 493
                      last_active_at: '2024-12-26T17:43:03Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                ListBrowserUsers401Example:
                  summary: Default listBrowserUsers 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                ListBrowserUsers403Example:
                  summary: Default listBrowserUsers 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                ListBrowserUsers500Example:
                  summary: Default listBrowserUsers 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    servers:
    - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
      description: AIOps for NGFW BPA API production server.
  /v1/users/{user_id}/sessions:
    get:
      operationId: getUserSessions
      summary: Palo Alto Networks Get User Sessions
      description: Returns the active and recent browser sessions for a specific user. Session data includes device, IP address, policy applied, and session duration.
      tags:
      - Users
      parameters:
      - name: user_id
        in: path
        required: true
        description: Unique identifier of the browser user.
        schema:
          type: string
        example: '194968'
      - name: status
        in: query
        description: Filter sessions by status.
        schema:
          type: string
          enum:
          - active
          - terminated
        example: active
      - name: limit
        in: query
        description: Maximum number of sessions to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: User sessions returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/BrowserSession'
              examples:
                GetUserSessions200Example:
                  summary: Default getUserSessions 200 response
                  x-microcks-default: true
                  value:
                    total: 788
                    items:
                    - session_id: '926940'
                      user_id: '494860'
                      device_id: '107670'
                      ip_address: 10.108.68.13
                      policy_id: '176224'
                      browser_version: 4.0.8
                      status: active
                      started_at: '2024-10-10T11:55:14Z'
                      ended_at: '2026-07-09T16:25:54Z'
                    - session_id: '926940'
                      user_id: '494860'
                      device_id: '107670'
                      ip_address: 10.108.68.13
                      policy_id: '176224'
                      browser_version: 4.0.8
                      status: active
                      started_at: '2024-10-10T11:55:14Z'
                      ended_at: '2026-07-09T16:25:54Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetUserSessions401Example:
                  summary: Default getUserSessions 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetUserSessions403Example:
                  summary: Default getUserSessions 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '404':
          description: User not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetUserSessions404Example:
                  summary: Default getUserSessions 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetUserSessions500Example:
                  summary: Default getUserSessions 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    servers:
    - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
      description: AIOps for NGFW BPA API production server.
  /api/users:
    get:
      operationId: listUsers
      summary: Palo Alto Networks List Users
      description: Returns the list of users discovered across connected SaaS applications. Includes user account details, access levels, and activity summaries.
      tags:
      - Users
      parameters:
      - name: app_id
        in: query
        description: Filter users by SaaS application.
        schema:
          type: string
        example: '860816'
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of users to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Users returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/User_2'
              examples:
                ListUsers200Example:
                  summary: Default listUsers 200 response
                  x-microcks-default: true
                  value:
                    total: 744
                    offset: 520
                    limit: 107
                    items:
                    - id: example-id
                      email: soc-admin@example.com
                      display_name: Sarah Doe
                      app_id: '562817'
                      account_type: internal
                      last_activity: '2025-01-07T13:18:09Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                ListUsers401Example:
                  summary: Default listUsers 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                ListUsers403Example:
                  summary: Default listUsers 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                ListUsers500Example:
                  summary: Default listUsers 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    servers:
    - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
      description: AIOps for NGFW BPA API production server.
  /api/user/{id}/activities:
    get:
      operationId: getUserActivities
      summary: Palo Alto Networks Get User Activity
      description: Returns the activity history for a specific user across connected SaaS applications. Activity includes file operations, sharing actions, login events, and policy-triggered events. Useful for user behavior analysis and insider threat investigations.
      tags:
      - Users
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the user.
        schema:
          type: string
        example: example-id
      - name: start_date
        in: query
        description: Filter activities on or after this date (ISO 8601).
        schema:
          type: string
          format: date-time
        example: '2026-02-17T15:55:16Z'
      - name: end_date
        in: query
        description: Filter activities on or before this date (ISO 8601).
        schema:
          type: string
          format: date-time
        example: '2026-03-09T19:54:03Z'
      - name: app_id
        in: query
        description: Filter activities by SaaS application.
        schema:
          type: string
        example: '492712'
      - name: limit
        in: query
        description: Maximum number of activity records to return.
        schema:
          type: integer
          default: 100
          maximum: 500
        example: 100
      responses:
        '200':
          description: User activities returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/UserActivity'
              examples:
                GetUserActivities200Example:
                  summary: Default getUserActivities 200 response
                  x-microcks-default: true
                  value:
                    total: 127
                    items:
                    - id: example-id
                      user_id: '269446'
                      app_id: '356501'
                      action: drop
                      asset_id: '505071'
                      timestamp: '2026-12-27T04:51:36Z'
                      ip_address: 10.201.17.66
                      risk_level: low
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                GetUserActivities401Example:
                  summary: Default getUserActivities 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                GetUserActivities403Example:
                  summary: Default getUserActivities 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
        '404':
          description: User not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                GetUserActivities404Example:
                  summary: Default getUserActivities 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured monitoring network blocked investigation applied activity.
                    request_id: 5cc3d66e-5479-4e15-bd64-849adde3cb60
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_2'
              examples:
                GetUserActivities500Example:
                  summary: Default getUserActivities 500 response
       

# --- truncated at 32 KB (47 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-users-api-openapi.yml