Palo Alto Networks Workload Issuance Policies API
APIs for Workload Issuance Policies.
OpenAPI Specification
openapi: 3.2.0
info:
title: TLS Protect Cloud API for Strata Cloud Manager Workload Issuance Policies API
description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
version: 1.0.0
license:
name: MIT
url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Workload Issuance Policies
description: APIs for Workload Issuance Policies.
paths:
/v1/distributedissuers/policies:
post:
description: Add a new a Workload Issuance Policy for an Issuer to use to ensure compliance with company restrictions for creating certificates.
operationId: policies_create
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyCreateRequest'
responses:
'201':
content:
application/json:
schema:
$ref: '#/components/schemas/ExtendedPolicyInformation'
description: Workload Issuance policy was created; details in response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
summary: Create a new Workload Issuance policy
tags:
- Workload Issuance Policies
get:
description: Retrieves all policy details for all Workload Issuance policies. Policies are sets of rules that constrain how certificates can be issued, as well as set default values for some fields.
operationId: policies_getAll
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyResponse'
description: All Workload Issuance policies; details in response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
summary: Get the details of all Workload
tags:
- Workload Issuance Policies
/v1/distributedissuers/policies/{id}:
get:
description: Retrieves the details of the Workload Issuance policy with the specified `id`.
operationId: policies_getById
parameters:
- description: Workload Issuance policy UUID
in: path
name: id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/ExtendedPolicyInformation'
description: Specified Workload Issuance policy found; details in response body.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Specified Workload Issuance policy was not found.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
summary: Get a Workload Issuance policy details
tags:
- Workload Issuance Policies
patch:
description: Updates (replaces) details of the Workload Issuance policy that has the specified `id`. Only fields specified in the request will be updated. Fields not included in the request will be ignored.
operationId: policies_update
parameters:
- description: Workload Issuance policy UUID
in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyUpdateRequest'
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/ExtendedPolicyInformation'
description: Workload Issuance policy updated.
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Workload Issuance policy was not found.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
summary: Update a Workload Issuance policy details
tags:
- Workload Issuance Policies
delete:
description: Deletes the Workload Issuance policy that has the specified `id`.
operationId: policies_delete
parameters:
- description: Workload Issuance policy UUID
in: path
name: id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/PolicyDeleteResponse'
description: Specified Workload Issuance policy was deleted
'400':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
'404':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Specified Workload Issuance policy was not found.
'412':
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse7'
description: Incomplete or malformed request.
summary: Remove a Workload Issuance policy
tags:
- Workload Issuance Policies
components:
schemas:
JwtStandardClaimsAuthenticationInformation:
allOf:
- $ref: '#/components/schemas/ClientAuthenticationInformation'
- properties:
audience:
description: Recipients that the JWT is intended for
example: Client1
maxLength: 256
type: string
clients:
description: List with clients, identified by processing JWTs that include standard/registered claims
items:
$ref: '#/components/schemas/JwtClientInformation'
minItems: 1
type: array
type: object
required:
- audience
- clients
type: object
AnyValue7:
description: Can be any value - string, number, boolean, array or object.
ErrorInformation7:
properties:
args:
items:
$ref: '#/components/schemas/AnyValue7'
type: array
code:
format: int32
type: integer
message:
type: string
type: object
ExtendedPolicyInformation:
properties:
companyId:
description: UUID specific to your company
example: 03eb6e61-9806-11ed-84f2-c747fb71e467
format: uuid
type: string
configurations:
items:
$ref: '#/components/schemas/ConfigurationInformation'
type: array
creationDate:
description: When the policy was initially created
example: '2022-10-10T14:50:41.710+00:00'
type: string
extendedKeyUsages:
description: Extended key usages
example:
- CLIENT_AUTH
- SERVER_AUTH
items:
enum:
- ANY
- SERVER_AUTH
- CLIENT_AUTH
- CODE_SIGNING
- EMAIL_PROTECTION
- IPSEC_ENDSYSTEM
- IPSEC_TUNNEL
- IPSEC_USER
- TIME_STAMPING
- OCSP_SIGNING
- DVCS
- SBGP_CERT_AA_SERVER_AUTH
- SCVP_RESPONDER
- EAP_OVER_PPP
- EAP_OVER_LAN
- SCVP_SERVER
- SCVP_CLIENT
- IPSEC_IKE
- CAPWAP_AC
- CAPWAP_WTP
- IPSEC_IKE_INTERMEDIATE
- SMARTCARD_LOGON
type: string
type: array
id:
description: UUID of the policy
example: 8ae92800-b1e0-11ed-859d-b39255f965ee
format: uuid
type: string
keyAlgorithm:
$ref: '#/components/schemas/KeyAlgorithmInformation'
keyUsages:
description: Key usages
example:
- keyEncipherment
- digitalSignature
items:
enum:
- digitalSignature
- nonRepudiation
- keyEncipherment
- dataEncipherment
- keyAgreement
- keyCertSign
- cRLSign
- encipherOnly
- decipherOnly
type: string
type: array
modificationDate:
description: When the policy was last modified
example: '2023-12-12T20:00:10.500+00:00'
type: string
name:
description: Name of the policy
example: Some policy
type: string
sans:
$ref: '#/components/schemas/SansInformation'
shareWithAll:
description: Shared with all sub-TSGs
example: false
type: boolean
sharedWithSubTsgIds:
items:
description: Sub-TSG IDs this policy is shared with
type: string
type: array
uniqueItems: true
subject:
$ref: '#/components/schemas/SubjectAttributesInformation'
validityPeriod:
description: ISO8601 Period Format
example: P30D
format: PnYnMnDTnHnMnS
type: string
type: object
ClientAuthorizationInformation:
properties:
customClaimsAliases:
$ref: '#/components/schemas/CustomClaimsAliasesInformation'
type: object
PolicyUpdateRequest:
properties:
extendedKeyUsages:
description: Extended key usages
example:
- CLIENT_AUTH
- SERVER_AUTH
items:
enum:
- ANY
- SERVER_AUTH
- CLIENT_AUTH
- CODE_SIGNING
- EMAIL_PROTECTION
- IPSEC_ENDSYSTEM
- IPSEC_TUNNEL
- IPSEC_USER
- TIME_STAMPING
- OCSP_SIGNING
- DVCS
- SBGP_CERT_AA_SERVER_AUTH
- SCVP_RESPONDER
- EAP_OVER_PPP
- EAP_OVER_LAN
- SCVP_SERVER
- SCVP_CLIENT
- IPSEC_IKE
- CAPWAP_AC
- CAPWAP_WTP
- IPSEC_IKE_INTERMEDIATE
- SMARTCARD_LOGON
type: string
type: array
keyAlgorithm:
$ref: '#/components/schemas/KeyAlgorithmInformation'
keyUsages:
description: Key usages
example:
- keyEncipherment
- digitalSignature
items:
enum:
- digitalSignature
- nonRepudiation
- keyEncipherment
- dataEncipherment
- keyAgreement
- keyCertSign
- cRLSign
- encipherOnly
- decipherOnly
type: string
type: array
name:
description: Name of the policy
example: Some policy
maxLength: 64
type: string
sans:
$ref: '#/components/schemas/SansInformation'
shareWithAll:
description: Share with all sub-TSGs
type: boolean
sharedWithSubTsgIds:
items:
description: Specific sub-TSG IDs to share with
example: '["1378242802","1896239460"]'
type: string
type: array
subject:
$ref: '#/components/schemas/SubjectAttributesInformation'
validityPeriod:
description: ISO8601 Period Format
example: P30D
format: PnYnMnDTnHnMnS
type: string
type: object
PolicyDeleteResponse:
properties:
id:
description: UUID of the policy
example: 8ae92800-b1e0-11ed-859d-b39255f965ee
format: uuid
type: string
name:
description: Name of the policy
example: Some policy
type: string
type: object
PropertyInformation:
properties:
allowedValues:
items:
type: string
type: array
defaultValues:
items:
type: string
type: array
maxOccurrences:
format: int32
type: integer
minOccurrences:
format: int32
type: integer
type:
enum:
- IGNORED
- FORBIDDEN
- OPTIONAL
- REQUIRED
- LOCKED
type: string
type: object
AwsCloudProviderInformation:
properties:
accountIds:
description: Array of AWS account IDs each of which should be a 12-digit identifier
example:
- '123456789012'
items:
type: string
minItems: 1
type: array
regions:
description: Array of AWS regions
example:
- us-west-1
items:
enum:
- us-east-1
- us-east-2
- us-west-1
- us-west-2
- af-south-1
- ap-east-1
- ap-south-2
- ap-southeast-3
- ap-southeast-4
- ap-south-1
- ap-northeast-3
- ap-northeast-2
- ap-southeast-1
- ap-southeast-2
- ap-northeast-1
- ca-central-1
- eu-central-1
- eu-west-1
- eu-west-2
- eu-south-1
- eu-west-3
- eu-south-2
- eu-north-1
- eu-central-2
- me-south-1
- me-central-1
- sa-east-1
- us-gov-east-1
- us-gov-west-1
type: string
type: array
required:
- accountIds
- regions
type: object
GoogleCloudProviderInformation:
properties:
projectIdentifiers:
description: Array of Google project identifiers each of which should be a string with int64 number or 6 to 30 lowercase letters, digits, or hyphens, should start with a letter and not contain trailing hyphens
example:
- '415104041262'
- tokyo-rain-123
items:
type: string
minItems: 1
type: array
regions:
description: Array of Google regions
example:
- us-west1
items:
enum:
- asia-east1
- asia-east2
- asia-northeast1
- asia-northeast2
- asia-northeast3
- asia-south1
- asia-south2
- asia-southeast1
- asia-southeast2
- australia-southeast1
- australia-southeast2
- europe-central2
- europe-north1
- europe-southwest1
- europe-west1
- europe-west12
- europe-west2
- europe-west3
- europe-west4
- europe-west6
- europe-west8
- europe-west9
- me-central1
- me-west1
- northamerica-northeast1
- northamerica-northeast2
- southamerica-east1
- southamerica-west1
- us-central1
- us-east1
- us-east4
- us-east5
- us-south1
- us-west1
- us-west2
- us-west3
- us-west4
type: string
type: array
required:
- projectIdentifiers
- regions
type: object
SubjectAttributesInformation:
description: Subject attributes
properties:
commonName:
$ref: '#/components/schemas/PropertyInformation'
country:
$ref: '#/components/schemas/PropertyInformation'
locality:
$ref: '#/components/schemas/PropertyInformation'
organization:
$ref: '#/components/schemas/PropertyInformation'
organizationalUnit:
$ref: '#/components/schemas/PropertyInformation'
stateOrProvince:
$ref: '#/components/schemas/PropertyInformation'
type: object
SansInformation:
description: Subject alternative names
properties:
dnsNames:
$ref: '#/components/schemas/PropertyInformation'
ipAddresses:
$ref: '#/components/schemas/PropertyInformation'
rfc822Names:
$ref: '#/components/schemas/PropertyInformation'
uniformResourceIdentifiers:
$ref: '#/components/schemas/PropertyInformation'
type: object
AzureCloudProviderInformation:
properties:
subscriptionIds:
description: Array of Azure subscription IDs each of which should be UUID
example:
- 8d10da13-8125-4ba9-a717-bf7490507b3d
items:
format: uuid
type: string
minItems: 1
type: array
required:
- subscriptionIds
type: object
CloudProvidersInformation:
properties:
aws:
$ref: '#/components/schemas/AwsCloudProviderInformation'
azure:
$ref: '#/components/schemas/AzureCloudProviderInformation'
google:
$ref: '#/components/schemas/GoogleCloudProviderInformation'
type: object
PolicyCreateRequest:
properties:
extendedKeyUsages:
description: Extended key usages
example:
- CLIENT_AUTH
- SERVER_AUTH
items:
enum:
- ANY
- SERVER_AUTH
- CLIENT_AUTH
- CODE_SIGNING
- EMAIL_PROTECTION
- IPSEC_ENDSYSTEM
- IPSEC_TUNNEL
- IPSEC_USER
- TIME_STAMPING
- OCSP_SIGNING
- DVCS
- SBGP_CERT_AA_SERVER_AUTH
- SCVP_RESPONDER
- EAP_OVER_PPP
- EAP_OVER_LAN
- SCVP_SERVER
- SCVP_CLIENT
- IPSEC_IKE
- CAPWAP_AC
- CAPWAP_WTP
- IPSEC_IKE_INTERMEDIATE
- SMARTCARD_LOGON
type: string
minItems: 1
type: array
keyAlgorithm:
$ref: '#/components/schemas/KeyAlgorithmInformation'
keyUsages:
description: Key usages
example:
- keyEncipherment
- digitalSignature
items:
enum:
- digitalSignature
- nonRepudiation
- keyEncipherment
- dataEncipherment
- keyAgreement
- keyCertSign
- cRLSign
- encipherOnly
- decipherOnly
type: string
minItems: 1
type: array
name:
description: Name of the policy
example: Some policy
maxLength: 64
type: string
sans:
$ref: '#/components/schemas/SansInformation'
shareWithAll:
description: Share with all sub-TSGs
example: false
type: boolean
sharedWithSubTsgIds:
items:
description: Specific sub-TSG IDs to share with
example: '["1378242802","1896239460"]'
type: string
type: array
subject:
$ref: '#/components/schemas/SubjectAttributesInformation'
validityPeriod:
description: ISO8601 Period Format
example: P30D
format: PnYnMnDTnHnMnS
type: string
required:
- extendedKeyUsages
- keyAlgorithm
- keyUsages
- name
- sans
- subject
- validityPeriod
type: object
KeyAlgorithmInformation:
description: Key algorithm
properties:
allowedValues:
description: Key algorithm allowed values
items:
enum:
- RSA_2048
- RSA_3072
- RSA_4096
- EC_P256
- EC_P384
- EC_P521
- EC_ED25519
type: string
minItems: 1
type: array
defaultValue:
description: Key algorithm default value
enum:
- RSA_2048
- RSA_3072
- RSA_4096
- EC_P256
- EC_P384
- EC_P521
- EC_ED25519
example: RSA_4096
type: string
required:
- allowedValues
- defaultValue
type: object
ErrorResponse7:
properties:
errors:
items:
$ref: '#/components/schemas/ErrorInformation7'
type: array
type: object
ConfigurationInformation:
properties:
advancedSettings:
$ref: '#/components/schemas/AdvancedSettingsInformation'
clientAuthentication:
$ref: '#/components/schemas/ClientAuthenticationInformation'
clientAuthorization:
$ref: '#/components/schemas/ClientAuthorizationInformation'
cloudProviders:
$ref: '#/components/schemas/CloudProvidersInformation'
companyId:
description: UUID specific to your company
example: 03eb6e61-9806-11ed-84f2-c747fb71e467
format: uuid
type: string
controllerAllowedPolicyIds:
description: Array of UUIDs of policies that the kubernetes controller is permitted to use
example:
- 8ae92800-b1e0-11ed-859d-b39255f965ee
format: uuid
items:
format: uuid
type: string
type: array
creationDate:
description: When the configuration was initially created
example: '2022-10-10T14:50:41.710+00:00'
type: string
id:
description: UUID of the configuration
example: 7268d820-a08d-11ed-bbc0-252385d6d389
format: uuid
type: string
longLivedCertCount:
description: Number of long lived certificates
example: 2
format: int64
type: integer
minTlsVersion:
description: Minimum required TLS protocol version
enum:
- TLS12
- TLS13
type: string
modificationDate:
description: When the configuration was last modified
example: '2023-12-12T20:00:10.500+00:00'
type: string
name:
description: Name of the configuration
example: Some configuration
type: string
policyIds:
description: Array of UUIDs of policies to associate with the configuration
example:
- 8ae92800-b1e0-11ed-859d-b39255f965ee
format: uuid
items:
format: uuid
type: string
type: array
serviceAccountIds:
items:
format: uuid
type: string
type: array
shortLivedCertCount:
description: Number of short lived certificates
example: 20
format: int64
type: integer
subTsgId:
description: Sub-TSG ID that owns this configuration (null for Primary TSG)
example: a007d406bf
type: string
ultraShortLivedCertCount:
description: Number of ultra short lived certificates
example: 200
format: int64
type: integer
unixSocketAllowedPolicyIds:
description: Array of UUIDs of policies that are permitted to be used when using the unix socket
example:
- 8ae92800-b1e0-11ed-859d-b39255f965ee
format: uuid
items:
format: uuid
type: string
type: array
type: object
ClientAuthenticationInformation:
discriminator:
propertyName: type
oneOf:
- $ref: '#/components/schemas/JwtStandardClaimsAuthenticationInformation'
- $ref: '#/components/schemas/JwtJwksAuthenticationInformation'
- $ref: '#/components/schemas/JwtOidcAuthenticationInformation'
properties:
type:
type: string
required:
- type
type: object
JwtOidcAuthenticationInformation:
allOf:
- $ref: '#/components/schemas/ClientAuthenticationInformation'
- properties:
audience:
description: OpenId audience
example: Client1
maxLength: 256
type: string
baseUrl:
description: JWT OpenId base URL
example: https://openid.example.com
maxLength: 2048
type: string
type: object
required:
- audience
- baseUrl
type: object
PolicyResponse:
properties:
policies:
items:
$ref: '#/components/schemas/ExtendedPolicyInformation'
type: array
type: object
JwtClientInformation:
properties:
allowedPolicyIds:
description: Array of UUIDs of policies that the client is permitted to use
example:
- 8ae92800-b1e0-11ed-859d-b39255f965ee
format: uuid
items:
format: uuid
type: string
minItems: 1
type: array
issuer:
description: Issuer of the JWT
example: https://kubernetes.default.svc
maxLength: 2048
type: string
jwksUri:
description: URL used to pull the trusted singing keys used for validation
example: https://www.example.com:6443/jwks
maxLength: 2048
type: string
name:
description: Name of the client
example: Some client
maxLength: 64
type: string
subjects:
description: Array of subjects of the JWT
example:
- system:serviceaccount:venafi:application-team-1
items:
type: string
minItems: 1
type: array
required:
- allowedPolicyIds
- issuer
- name
- subjects
type: object
CustomClaimsAliasesInformation:
properties:
allowAllPolicies:
maxLength: 128
type: string
allowedPolicies:
maxLength: 128
type: string
configuration:
maxLength: 128
type: string
type: object
JwtJwksAuthenticationInformation:
allOf:
- $ref: '#/components/schemas/ClientAuthenticationInformation'
- properties:
urls:
description: Array of JWT JWKS urls
example:
- https://jwks.example.com
items:
type: string
minItems: 1
type: array
type: object
required:
- urls
type: object
AdvancedSettingsInformation:
properties:
enableIssuanceAuditLog:
description: Whether audit log entries must be generated for each issued certificate
example: false
type: boolean
includeRawCertDataInAuditLog:
description: Whether the raw certificate data must be included in the audit log entry
example: false
type: boolean
requireFIPSCompliantBuild:
description: Whether FIPS-compliant build is required
example: false
type: boolean
type: object
securitySchemes:
scmOAuth:
type: oauth2
description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
flows:
clientCredentials:
tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
scopes: {}
scmToken:
type: http
description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
scheme: bearer
bearerFormat: JWT