Palo Alto Networks Vlan Attachment API
The Vlan Attachment API from Palo Alto Networks — 4 operation(s) for vlan attachment.
OpenAPI Specification
openapi: 3.2.0
info:
title: SP Interconnect Manage Vlan Attachment API
version: '1.0'
description: "These APIs provide the administrative tools necessary to configure and manage the lifecycle of Service Provider (SP) Interconnects \nand virtual VlanAttachments within the management plane. They enable administrators to establish private, secure bridges between Service Providers \nand Prisma Access to bypass public cloud backbones. Use these tools during initial deployment or regional expansion to provision high-capacity physical and virtual links. \nBy submitting specific interconnect requests, you can manage bandwidth allocations and routing parameters to ensure secure, dedicated connectivity for your global infrastructure. This spec was created on February 13, 2026. © 2026 Palo Alto Networks, Inc."
servers:
- url: https://api.sase.paloaltonetworks.com
security:
- authKey: []
tags:
- name: Vlan Attachment
paths:
/mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments:
get:
tags:
- Vlan Attachment
summary: List Vlan Attachments
description: Retrieve all virtual circuits configured within a specific Interconnect. This allows administrators to verify the regional distribution of attachments and their current BGP states. Use this when auditing high-availability (HA) domains or verifying pairing key availability. The response lists BGP parameters, edge availability domains, and current provisioning states for each circuit.
parameters:
- name: interconnectId
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
examples:
Get vlan attachments in an interconnect:
value:
data:
- bfdEnabled: false
bgpPeerAsn: 16363
bgpPeerBfdSessionInitMode: DISABLED
bgpPeerMd5AuthEnabled: false
createTime: 1758575564100
edgeAvailability: AVAILABILITY_DOMAIN_2
id: 0182b459-6ddd-41cc-9f45-60af08e7ec2b
name: test-2
permittedActions: []
stackType: IPV4_ONLY
state: NOT_STARTED
status: INACTIVE
tenantCount: 0
updateTime: 1758575564106
- bfdEnabled: false
bgpPeerAsn: 16363
bgpPeerBfdSessionInitMode: DISABLED
bgpPeerMd5AuthEnabled: false
createTime: 1758575564075
edgeAvailability: AVAILABILITY_DOMAIN_1
id: 73d4c1c1-ee4a-4fc3-98f0-45e465c17c5e
name: test-1
permittedActions: []
stackType: IPV4_ONLY
state: NOT_STARTED
status: INACTIVE
tenantCount: 0
updateTime: 1758575564082
requestId: 21f951d8-0d34-48cb-ae3e-29fcc5339bea
'400':
description: Bad Request
'500':
description: Server Error
operationId: GetMtSp-interconnectInterconnectsBy_interconnectidVlan-attachments
post:
tags:
- Vlan Attachment
summary: Provision Vlan Attachment
description: Create a new virtual circuit, known as a VlanAttachment, within an Interconnect to enable data transfer. This establishes the actual logical path for Prisma Access traffic routing through the Service Provider. Deploy this when initializing new egress paths or adding redundant links for regional reliability. Required parameters include a unique name, BGP Peer ASN, and BFD initialization mode to ensure robust connectivity.
parameters:
- name: interconnectId
in: path
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/VlanAttachmentRequest'
examples:
Create Partner VLAN attachment:
value:
name: test
bgpPeerAsn: 16550
bgpPeerBfdSessionInitMode: DISABLED
stackType: IPV4_ONLY
bgpPeerMd5AuthEnabled: false
Create VLAN attachment with BFD enabled:
value:
name: bfd-conn
bgpPeerAsn: 65001
bgpPeerBfdSessionInitMode: ACTIVE
bgpPeerBfdMinTransmitInterval: 1000
bgpPeerBfdMinReceiveInterval: 1000
bgpPeerBfdMultiplier: 5
stackType: IPV4_ONLY
bgpPeerMd5AuthEnabled: true
Create VLAN attachment with IPv4/IPv6:
value:
name: dual-stack
bgpPeerAsn: 64512
bgpPeerBfdSessionInitMode: PASSIVE
stackType: IPV4_IPV6
bgpPeerMd5AuthEnabled: false
Create Dedicated VLAN attachment:
value:
name: ded-vlan
bgpPeerAsn: 16363
bgpPeerBfdSessionInitMode: ACTIVE
bandwidth: BPS_10G
stackType: IPV4_ONLY
bgpPeerMd5AuthEnabled: true
dedicatedConnectionDetails:
- edgeAvailability: ZONE1
bandwidth: BPS_10G
- edgeAvailability: ZONE2
bandwidth: BPS_10G
Create VLAN attachment with custom IP addresses:
value:
name: custom-ip-vlan
bgpPeerAsn: 65001
bgpPeerBfdSessionInitMode: ACTIVE
stackType: IPV4_ONLY
bgpPeerMd5AuthEnabled: false
primaryAttachmentCustomIpAddress:
candidateCloudRouterIpAddress: 169.254.1.1/29
candidateCustomerRouterIpAddress: 169.254.1.2/29
redundantAttachmentCustomIpAddress:
candidateCloudRouterIpAddress: 169.254.2.1/29
candidateCustomerRouterIpAddress: 169.254.2.2/29
required: true
responses:
'201':
description: Success
content:
application/json:
examples:
Add vlan attachment in interconnect:
value:
data:
- bfdEnabled: false
bgpPeerAsn: 16363
bgpPeerBfdSessionInitMode: DISABLED
bgpPeerMd5AuthEnabled: false
createTime: 1758575564075
edgeAvailability: AVAILABILITY_DOMAIN_1
id: 73d4c1c1-ee4a-4fc3-98f0-45e465c17c5e
name: test-1
permittedActions: []
stackType: IPV4_ONLY
state: NOT_STARTED
status: INACTIVE
tenantCount: 0
updateTime: 1758575564077
- bfdEnabled: false
bgpPeerAsn: 16363
bgpPeerBfdSessionInitMode: DISABLED
bgpPeerMd5AuthEnabled: false
createTime: 1758575564100
edgeAvailability: AVAILABILITY_DOMAIN_2
id: 0182b459-6ddd-41cc-9f45-60af08e7ec2b
name: test-2
permittedActions: []
stackType: IPV4_ONLY
state: NOT_STARTED
status: INACTIVE
tenantCount: 0
updateTime: 1758575564101
requestId: 73811958-f1a9-4a3e-b5f1-b9373eeb4000
Add vlan attachment with custom IP addresses:
value:
data:
- bfdEnabled: false
bgpPeerAsn: 65001
bgpPeerBfdSessionInitMode: ACTIVE
bgpPeerMd5AuthEnabled: false
createTime: 1758575564075
edgeAvailability: AVAILABILITY_DOMAIN_1
id: 73d4c1c1-ee4a-4fc3-98f0-45e465c17c5e
name: custom-ip-vlan-1
permittedActions: []
stackType: IPV4_ONLY
state: NOT_STARTED
status: INACTIVE
tenantCount: 0
updateTime: 1758575564077
customIpAddress:
candidateCloudRouterIpAddress: 169.254.1.1/29
candidateCustomerRouterIpAddress: 169.254.1.2/29
- bfdEnabled: false
bgpPeerAsn: 65001
bgpPeerBfdSessionInitMode: ACTIVE
bgpPeerMd5AuthEnabled: false
createTime: 1758575564100
edgeAvailability: AVAILABILITY_DOMAIN_2
id: 0182b459-6ddd-41cc-9f45-60af08e7ec2b
name: custom-ip-vlan-2
permittedActions: []
stackType: IPV4_ONLY
state: NOT_STARTED
status: INACTIVE
tenantCount: 0
updateTime: 1758575564101
customIpAddress:
candidateCloudRouterIpAddress: 169.254.2.1/29
candidateCustomerRouterIpAddress: 169.254.2.2/29
requestId: 73811958-f1a9-4a3e-b5f1-b9373eeb4000
'404':
description: Not Found
content:
application/json:
examples:
Add vlan attachment, interconnect not found:
value:
error:
errorCode: 52008
errorType: VALIDATION_ERROR
httpStatus: 404
msg: Interconnect not found
requestId: 95203e0e-e0f7-49ef-9b9d-04c9ba42e95b
'400':
description: Bad Request
content:
application/json:
examples:
VLAN attachment name exists:
value:
error:
errorCode: 52011
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Connection name already exists
requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890
Max vlan attachments reached:
value:
error:
errorCode: 52018
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Reached maximum number of vlan attachments in an interconnect
requestId: b2c3d4e5-6f78-9012-bcde-f12345678901
Dedicated connection details missing:
value:
error:
errorCode: 52025
errorType: VALIDATION_ERROR
httpStatus: 400
msg: dedicatedVlanAttachmentDetails cannot be null for Connection with type DEDICATED
requestId: c3d4e5f6-7890-1234-cdef-012345678901
Bandwidth required for dedicated:
value:
error:
errorCode: 52026
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Bandwidth is required input for dedicated VLAN Attachment
requestId: d4e5f678-9012-3456-def0-123456789012
Invalid custom IP addresses:
value:
error:
errorCode: 52027
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Cloud Router IP and Peer IP must both be set or must both be unset. If set, the prefix lengths must be the same, IP addresses must not be in reserved ranges, and must not be network or broadcast addresses.
requestId: e6f78901-2345-6789-0123-456789012345
'500':
description: Server Error
operationId: PostMtSp-interconnectInterconnectsBy_interconnectidVlan-attachments
/mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments/{vlanAttachmentId}:
get:
tags:
- Vlan Attachment
summary: Get Vlan Attachment
description: View the full technical specification of a single virtual circuit by its unique identifier. This displays parameters such as MD5 authentication, BGP session timers, and stack type (IPv4/Dual-Stack). Use this to verify pairing key generation or to inspect the specific edge availability domain assigned for redundancy. The returned data provides the exact state needed for alignment with service provider configurations.
parameters:
- name: interconnectId
in: path
required: true
schema:
type: string
- name: vlanAttachmentId
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
examples:
Get vlan attachment by Id:
value:
data:
bandwidth: BPS_50M
bgpPeerAsn: 16550
edgeAvailability: ZONE1
id: dee52272-d1e2-4b88-9ebc-a5e70e414d58
name: abc-edge-1
partnerEmail: sp@mail.com
partnerName: sp_abc_name
region: us-central1
state: CREATED_CONNECTION
status: PENDING
bgpPeerBfdMinReceiveInterval: 1000
bgpPeerBfdMinTransmitInterval: 1000
bgpPeerBfdMultiplier: 5
bgpPeerMd5AuthEnabled: true
requestId: 138de731-25c2-4001-8ea5-d81992c146d7
'400':
description: Bad Request
'500':
description: Server Error
operationId: GetMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentid
delete:
tags:
- Vlan Attachment
summary: Delete Vlan Attachment
description: Permanently remove a specific virtual circuit and its logical configuration from the Interconnect. Terminating these circuits is necessary when network paths are being replaced or retired. Execute this during scheduled maintenance windows or regional re-architecting. Ensure the paired service provider resource is also manually decommissioned to prevent unintended billing.
parameters:
- name: interconnectId
in: path
required: true
schema:
type: string
- name: vlanAttachmentId
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
examples:
Delete vlan attachment by Id:
value:
data: Successfully delete VLAN Attachment
requestId: 7e656271-20f3-4fa4-9c4a-e0f455476fe9
'404':
description: Not Found
content:
application/json:
examples:
Delete vlan attachment, interconnect not found:
value:
error:
errorCode: 52008
errorType: VALIDATION_ERROR
httpStatus: 404
msg: Interconnect not found
requestId: d56d092a-7cb2-4b85-bdbe-48c02c036c94
'400':
description: Bad Request
'500':
description: Server Error
operationId: DeleteMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentid
/mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments/{vlanAttachmentId}/accept:
post:
tags:
- Vlan Attachment
summary: Accept AWS Attachment
description: Transition a pending AWS Direct Connect attachment into the accepted state within the management plane. This serves as the final confirmation required by AWS to activate the virtual circuit. Trigger this action when the circuit state reaches PENDING_SP_ACCEPTANCE in the AWS console. Note that this action is exclusive to AWS deployments and cannot be used for GCP or other providers.
parameters:
- name: interconnectId
in: path
required: true
schema:
type: string
- name: vlanAttachmentId
in: path
required: true
schema:
type: string
responses:
'200':
description: Success
content:
application/json:
examples:
Accept AWS vlan attachment:
value:
data: Successfully accepted VLAN Attachment
requestId: 7e656271-20f3-4fa4-9c4a-e0f455476fe9
'400':
description: Bad Request
content:
application/json:
examples:
Accept non-AWS vlan attachment:
value:
error:
errorCode: 52047
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Connections created in AWS can be accepted
requestId: 95203e0e-e0f7-49ef-9b9d-04c9ba42e95b
Accept vlan attachment not in pending state:
value:
error:
errorCode: 52046
errorType: VALIDATION_ERROR
httpStatus: 400
msg: VlanAttachment can be accepted only in PENDING_SP_ACCEPTANCE state
requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890
'404':
description: Not Found
content:
application/json:
examples:
Interconnect not found:
value:
error:
errorCode: 52008
errorType: VALIDATION_ERROR
httpStatus: 404
msg: Interconnect not found
requestId: d56d092a-7cb2-4b85-bdbe-48c02c036c94
Vlan attachment not found:
value:
error:
errorCode: 52029
errorType: VALIDATION_ERROR
httpStatus: 404
msg: Vlan Attachment not found
requestId: cf32af05-7df6-4dd2-b27e-7b6ef2683145
'500':
description: Server Error
content:
application/json:
examples:
Accept AWS vlan attachment failed:
value:
error:
errorCode: 52048
errorType: INTERNAL_ERROR
httpStatus: 500
msg: Failed to accept vlan attachment in aws
requestId: d42dba1a-23f1-4818-813b-2da9f35c95bb
operationId: PostMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentidAccept
/mt/sp-interconnect/interconnects/{interconnectId}/vlan-attachments/{vlanAttachmentId}/logs:
get:
tags:
- Vlan Attachment
summary: Get GCP CloudRouter Logs
description: Get GCP cloudRouter logs for vlan attachment from startTime to endTime milliseconds.
parameters:
- name: interconnectId
in: path
required: true
schema:
type: string
- name: vlanAttachmentId
in: path
required: true
schema:
type: string
- name: duration
in: query
description: 'Duration for logs. Allowed values: 15m, 1h, 1d, 3d'
schema:
type: string
default: 1d
enum:
- 15m
- 1h
- 1d
- 3d
responses:
'200':
description: Success
content:
application/json:
examples:
Get cloud router logs:
value:
data:
logs:
- timestamp: 1758576695399
severity: INFO
message: BGP session established with peer 10.0.0.1
- timestamp: 1758576779732
severity: WARNING
message: BGP hold timer expired, resetting session
requestId: 82923271-2db3-4895-b1cf-a5faa77d28e3
'400':
description: Bad Request
content:
application/json:
examples:
Invalid duration:
value:
error:
errorCode: 52091
errorType: VALIDATION_ERROR
httpStatus: 400
msg: Invalid duration, allowed duration are 15m, 1h, 1d, 3d
requestId: 95203e0e-e0f7-49ef-9b9d-04c9ba42e95b
Logs not supported for AWS:
value:
error:
errorCode: 52092
errorType: VALIDATION_ERROR
httpStatus: 400
msg: CloudRouter logs supported only for GCP connections
requestId: a1b2c3d4-5e6f-7890-abcd-ef1234567890
'500':
description: Server Error
content:
application/json:
examples:
Failed to get logs:
value:
error:
errorCode: 52090
errorType: INTERNAL_ERROR
httpStatus: 500
msg: Failed getting cloud router logs from GCP
requestId: d42dba1a-23f1-4818-813b-2da9f35c95bb
operationId: GetMtSp-interconnectInterconnectsBy_interconnectidVlan-attachmentsBy_vlanattachmentidLogs
components:
schemas:
SessionInitializationMode:
type: string
enum:
- ACTIVE
- PASSIVE
- DISABLED
VlanAttachmentRequest:
type: object
required:
- name
- bgpPeerAsn
- bgpPeerBfdSessionInitMode
properties:
name:
type: string
pattern: ^([-0-9a-z]){1,13}$
stackType:
$ref: '#/components/schemas/StackType'
bandwidth:
$ref: '#/components/schemas/Bandwidth'
bgpPeerAsn:
type: integer
format: int64
minimum: 1
bgpPeerBfdSessionInitMode:
$ref: '#/components/schemas/SessionInitializationMode'
bgpPeerBfdMinTransmitInterval:
type: integer
format: int64
maximum: 30000
minimum: 1000
bgpPeerBfdMinReceiveInterval:
type: integer
format: int64
maximum: 30000
minimum: 1000
bgpPeerBfdMultiplier:
type: integer
format: int64
maximum: 16
minimum: 5
dedicatedConnectionDetails:
type: array
items:
$ref: '#/components/schemas/DedicatedVlanAttachmentDetailsEntry'
primaryAttachmentCustomIpAddress:
$ref: '#/components/schemas/VlanAttachmentCustomIpAddress'
redundantAttachmentCustomIpAddress:
$ref: '#/components/schemas/VlanAttachmentCustomIpAddress'
bgpPeerMd5AuthEnabled:
type: boolean
StackType:
type: string
enum:
- IPV4_ONLY
- IPV4_IPV6
DedicatedVlanAttachmentDetailsEntry:
type: object
properties:
edgeAvailability:
type: string
bandwidth:
$ref: '#/components/schemas/Bandwidth'
required:
- edgeAvailability
VlanAttachmentCustomIpAddress:
type: object
description: Custom IP address configuration for VLAN attachment BGP peering. Both Cloud Router and Customer Router IP addresses must be provided together with matching prefix lengths (/29 or /30). IP addresses must not be in reserved ranges (RFC1918 private IPs, loopback, etc.) and must not be network or broadcast addresses.
properties:
candidateCloudRouterIpAddress:
type: string
description: Cloud Router IP address in CIDR notation (e.g., 169.254.1.1/29). Must have prefix length /29 or /30 and match the prefix length of candidateCustomerRouterIpAddress.
pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))/(29|30)$
candidateCustomerRouterIpAddress:
type: string
description: Customer Router IP address in CIDR notation (e.g., 169.254.1.2/29). Must have prefix length /29 or /30 and match the prefix length of candidateCloudRouterIpAddress.
pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))/(29|30)$
Bandwidth:
type: string
enum:
- BPS_50M
- BPS_100M
- BPS_200M
- BPS_300M
- BPS_400M
- BPS_500M
- BPS_1G
- BPS_2G
- BPS_5G
- BPS_10G
securitySchemes:
authKey:
type: http
scheme: Bearer