Palo Alto Networks Zone Protection Profiles API
Zone Protection Profiles
OpenAPI Specification
openapi: 3.2.0
info:
version: 2.0.0
title: Network Services Zone Protection Profiles API
description: These APIs are used for defining and managing network services configuration within Strata Cloud Manager.
termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
contact:
email: support@paloaltonetworks.com
name: Palo Alto Networks Technical Support
url: https://support.paloaltonetworks.com
license:
name: MIT
url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/config/network/v1
description: Current
- url: https://api.sase.paloaltonetworks.com/sse/config/v1
description: Legacy
security:
- scmToken: []
tags:
- name: Zone Protection Profiles
description: Zone Protection Profiles
paths:
/zone-protection-profiles:
get:
tags:
- Zone Protection Profiles
summary: List zone protection profiles
description: 'Retrieve a list of zone protection profiles.
'
operationId: ListZoneProtectionProfiles
parameters:
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/offset'
- $ref: '#/components/parameters/name'
- $ref: '#/components/parameters/folder'
- $ref: '#/components/parameters/snippet'
- $ref: '#/components/parameters/device'
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
data:
allOf:
- type: array
items:
$ref: '#/components/schemas/zone-protection-profiles'
limit:
type: integer
default: 200
offset:
type: integer
default: 0
total:
type: integer
'400':
$ref: '#/components/responses/bad_request_errors_basic'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
default:
$ref: '#/components/responses/default_errors'
post:
tags:
- Zone Protection Profiles
summary: Create a zone protection profile
description: 'Create a new zone protection profile.
'
operationId: CreateZoneProtectionProfiles
requestBody:
description: Created
content:
application/json:
schema:
$ref: '#/components/schemas/zone-protection-profiles'
responses:
'201':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/zone-protection-profiles'
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors'
/zone-protection-profiles/{id}:
get:
tags:
- Zone Protection Profiles
summary: Get a zone protection profile
description: 'Get an existing zone protection profile.
'
operationId: GetZoneProtectionProfilesByID
parameters:
- $ref: '#/components/parameters/uuid'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/zone-protection-profiles'
'400':
$ref: '#/components/responses/bad_request_errors_basic'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
default:
$ref: '#/components/responses/default_errors'
put:
tags:
- Zone Protection Profiles
summary: Update a zone protection profile
description: 'Update an existing zone protection profile.
'
operationId: UpdateZoneProtectionProfilesByID
parameters:
- $ref: '#/components/parameters/uuid'
requestBody:
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/zone-protection-profiles'
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/zone-protection-profiles'
'400':
$ref: '#/components/responses/bad_request_errors_basic_with_body'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors'
delete:
tags:
- Zone Protection Profiles
summary: Delete a zone protection profile
description: 'Delete a zone protection profile.
'
operationId: DeleteZoneProtectionProfilesByID
parameters:
- $ref: '#/components/parameters/uuid'
responses:
'200':
$ref: '#/components/responses/http_ok'
'400':
$ref: '#/components/responses/bad_request_errors_basic'
'401':
$ref: '#/components/responses/auth_errors'
'403':
$ref: '#/components/responses/access_errors'
'404':
$ref: '#/components/responses/not_found'
'409':
$ref: '#/components/responses/conflict_errors'
default:
$ref: '#/components/responses/default_errors'
components:
examples:
json_401_panui_auth_key_expired:
summary: Key Expired
value:
_errors:
- code: E016
message: Key Expired
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_501_panui_restapi_method_not_supported:
summary: Method Not Supported
value:
_errors:
- code: E012
message: Method Not Supported
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_input_format_mismatch:
summary: Input Format Mismatch
value:
_errors:
- code: E003
message: 'Input Format Mismatch: input-format=json'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_501_panui_restapi_version_not_supported:
summary: Version Not Supported
value:
_errors:
- code: E012
message: Version Not Supported
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_409_panui_mgmt_name_not_unique:
summary: Name Not Unique
value:
_errors:
- code: E006
message: Name Not Unique
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_409_panui_mgmt_object_not_unique:
summary: Object Not Unique
value:
_errors:
- code: E016
message: Object Not Unique
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_404_panui_mgmt_object_not_present:
summary: Object Not Present
value:
_errors:
- code: E005
message: Object Not Present
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_missing_body:
summary: Missing Body
value:
_errors:
- code: E003
message: Missing Body
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_409_panui_mgmt_reference_not_zero:
summary: Reference Not Zero
value:
_errors:
- code: E009
message: Reference Not Zero
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_mgmt_invalid_command:
summary: Invalid Command
value:
_errors:
- code: E003
message: Invalid Command
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_output_format_mismatch:
summary: Output Format Mismatch
value:
_errors:
- code: E003
message: 'Output Format Mismatch: output-format=json Accept=xml'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_401_panui_auth_not_authenticated:
summary: Not Authenticated
value:
_errors:
- code: E016
message: Not Authenticated
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_401_panui_auth_invalid_credential:
summary: Invalid Credential
value:
_errors:
- code: E016
message: Invalid Credential
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_403_panui_auth_unauthorized:
summary: Unauthorized
value:
_errors:
- code: E007
message: Unauthorized
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_missing_query_parameter:
summary: Missing Query Parameter
value:
_errors:
- code: E003
message: 'Missing Query Parameter: name'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_405_panui_restapi_action_not_supported:
summary: Action Not Supported
value:
_errors:
- code: E012
message: 'Action Not Supported: move'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_restapi_invalid_query_parameter:
summary: Invalid Query Parameter
value:
_errors:
- code: E003
message: 'Invalid Query Parameter: location=invalid'
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_401_panui_auth_key_too_long:
summary: Key Too Long
value:
_errors:
- code: E016
message: Key Too Long
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_mgmt_invalid_object:
summary: Invalid Object
value:
_errors:
- code: E003
message: Invalid Object
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_mgmt_malformed_command:
summary: Malformed Command
value:
_errors:
- code: E003
message: Malformed Command
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_504_panui_mgmt_session_timeout:
summary: Session Timeout
value:
_errors:
- code: '4'
message: Session Timeout
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_401_panui_auth_need_password_change:
summary: Need Password Change
value:
_errors:
- code: E016
message: The password needs to be changed.
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
json_400_panui_mgmt_bad_xpath:
summary: Bad XPath
value:
_errors:
- code: E013
message: Bad XPath
details: {}
_request_id: 123e4567-e89b-12d3-a456-426655440000
parameters:
uuid:
name: id
in: path
description: The UUID of the configuration resource
required: true
schema:
type: string
format: uuid
example: 123e4567-e89b-12d3-a456-426655440000
name:
name: name
in: query
description: The name of the configuration resource
required: false
schema:
type: string
limit:
name: limit
in: query
description: The maximum number of results per page
required: false
schema:
type: integer
default: 200
folder:
name: folder
in: query
description: 'The folder in which the resource is defined
'
required: false
schema:
type: string
snippet:
name: snippet
in: query
description: 'The snippet in which the resource is defined
'
required: false
schema:
type: string
offset:
name: offset
in: query
description: The offset into the list of results returned
required: false
schema:
type: integer
default: 0
device:
name: device
in: query
description: 'The device in which the resource is defined
'
required: false
schema:
type: string
responses:
http_ok:
description: OK
not_found:
description: Not Found
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
object_not_present:
$ref: '#/components/examples/json_404_panui_mgmt_object_not_present'
default_errors:
description: General Errors
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
version_not_supported:
$ref: '#/components/examples/json_501_panui_restapi_version_not_supported'
method_not_allowed:
$ref: '#/components/examples/json_501_panui_restapi_method_not_supported'
action_not_supported:
$ref: '#/components/examples/json_405_panui_restapi_action_not_supported'
bad_xpath:
$ref: '#/components/examples/json_400_panui_mgmt_bad_xpath'
invalid_command:
$ref: '#/components/examples/json_400_panui_mgmt_invalid_command'
malformed_command:
$ref: '#/components/examples/json_400_panui_mgmt_malformed_command'
session_timeout:
$ref: '#/components/examples/json_504_panui_mgmt_session_timeout'
bad_request_errors_basic_with_body:
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
input_format_mismatch:
$ref: '#/components/examples/json_400_panui_restapi_input_format_mismatch'
output_format_mismatch:
$ref: '#/components/examples/json_400_panui_restapi_output_format_mismatch'
missing_query_parameter:
$ref: '#/components/examples/json_400_panui_restapi_missing_query_parameter'
invalid_query_parameter:
$ref: '#/components/examples/json_400_panui_restapi_invalid_query_parameter'
missing_body:
$ref: '#/components/examples/json_400_panui_restapi_missing_body'
invalid_object:
$ref: '#/components/examples/json_400_panui_mgmt_invalid_object'
bad_request_errors_basic:
description: Bad Request
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
input_format_mismatch:
$ref: '#/components/examples/json_400_panui_restapi_input_format_mismatch'
output_format_mismatch:
$ref: '#/components/examples/json_400_panui_restapi_output_format_mismatch'
missing_query_parameter:
$ref: '#/components/examples/json_400_panui_restapi_missing_query_parameter'
invalid_query_parameter:
$ref: '#/components/examples/json_400_panui_restapi_invalid_query_parameter'
auth_errors:
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
auth_not_authenticated:
$ref: '#/components/examples/json_401_panui_auth_not_authenticated'
invalid_credential:
$ref: '#/components/examples/json_401_panui_auth_invalid_credential'
key_too_long:
$ref: '#/components/examples/json_401_panui_auth_key_too_long'
key_expired:
$ref: '#/components/examples/json_401_panui_auth_key_expired'
need_password_change:
$ref: '#/components/examples/json_401_panui_auth_need_password_change'
conflict_errors:
description: Conflict
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
object_not_unique:
$ref: '#/components/examples/json_409_panui_mgmt_object_not_unique'
name_not_unique:
$ref: '#/components/examples/json_409_panui_mgmt_name_not_unique'
reference_not_zero:
$ref: '#/components/examples/json_409_panui_mgmt_reference_not_zero'
access_errors:
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/generic_error'
examples:
auth_unauthorized:
$ref: '#/components/examples/json_403_panui_auth_unauthorized'
schemas:
generic_error:
type: object
properties:
_errors:
$ref: '#/components/schemas/error_detail_cause_infos'
_request_id:
type: string
x-examples: {}
error_detail_cause_info:
type: object
title: Cause Info
properties:
code:
type: string
message:
type: string
details:
oneOf:
- type: string
- type: object
help:
type: string
error_detail_cause_infos:
type: array
items:
$ref: '#/components/schemas/error_detail_cause_info'
x-examples: {}
zone-protection-profiles:
type: object
properties:
id:
type: string
description: UUID of the resource
readOnly: true
example: 123e4567-e89b-12d3-a456-426655440000
name:
description: The profile name
type: string
maxLength: 31
description:
description: The description of the profile
type: string
maxLength: 255
flood:
type: object
properties:
tcp_syn:
type: object
properties:
enable:
description: Enable protection against SYN floods?
type: boolean
oneOf:
- title: red
type: object
properties:
alarm_rate:
description: When the flow exceeds the `alert_rate`` threshold, an alarm is generated.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
activate_rate:
description: When the flow exceeds the `activate_rate`` threshold, the firewall drops individual SYN packets randomly to restrict the flow.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
maximal_rate:
description: When the flow exceeds the `maximal_rate` threshold, 100% of incoming SYN packets are dropped.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 40000
required:
- alarm_rate
- activate_rate
- maximal_rate
- title: syn_cookies
type: object
properties:
alarm_rate:
description: When the flow exceeds the `alert_rate`` threshold, an alarm is generated.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
activate_rate:
description: When the flow exceeds the `activate_rate`` threshold, the firewall drops individual SYN packets randomly to restrict the flow.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 0
maximal_rate:
description: When the flow exceeds the `maximal_rate` threshold, 100% of incoming SYN packets are dropped.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 1000000
required:
- alarm_rate
- activate_rate
- maximal_rate
udp:
type: object
properties:
enable:
description: Enable protection against UDP floods?
type: boolean
red:
type: object
properties:
alarm_rate:
description: The number of UDP packets (not matching an existing session) that the zone receives per second that triggers an attack alarm.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
activate_rate:
description: The number of UDP packets (not matching an existing session) that the zone receives per second that triggers random dropping of UDP packets.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
maximal_rate:
description: The maximum number of UDP packets (not matching an existing session) the zone receives per second before packets exceeding the maximum are dropped.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 40000
required:
- alarm_rate
- activate_rate
- maximal_rate
sctp_init:
type: object
properties:
enable:
description: Enable protection against floods of Stream Control Transmission Protocol (SCTP) packets that contain an Initiation (INIT) chunk?
type: boolean
red:
type: object
properties:
alarm_rate:
description: The number of SCTP INIT packets (not matching an existing session) that the zone receives per second that triggers an attack alarm.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
activate_rate:
description: The number of SCTP INIT packets (not matching an existing session) that the zone receives per second before subsequent SCTP INIT packets are dropped.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
maximal_rate:
description: The maximum number of SCTP INIT packets (not matching an existing session) that the zone receives per second before packets exceeding the maximum are dropped.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
required:
- alarm_rate
- activate_rate
- maximal_rate
icmp:
type: object
properties:
enable:
description: Enable protection against ICMP floods?
type: boolean
red:
type: object
properties:
alarm_rate:
description: The number of ICMP echo requests (pings not matching an existing session) that the zone receives per second that triggers an attack alarm.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
activate_rate:
description: The number of ICMP packets (not matching an existing session) that the zone receives per second before subsequent ICMP packets are dropped.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
maximal_rate:
description: The maximum number of ICMP packets (not matching an existing session) that the zone receives per second before packets exceeding the maximum are dropped.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 40000
required:
- alarm_rate
- activate_rate
- maximal_rate
icmpv6:
type: object
properties:
enable:
description: Enable protection against ICMPv6 floods?
type: boolean
red:
type: object
properties:
alarm_rate:
description: The number of ICMPv6 echo requests (pings not matching an existing session) that the zone receives per second that triggers an attack alarm.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
activate_rate:
description: The number of ICMPv6 packets (not matching an existing session) that the zone receives per second before subsequent ICMPv6 packets are dropped.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
maximal_rate:
description: The maximum number of ICMPv6 packets (not matching an existing session) that the zone receives per second before packets exceeding the maximum are dropped.
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 40000
required:
- alarm_rate
- activate_rate
- maximal_rate
other_ip:
type: object
properties:
enable:
description: Enable protection against other IP (non-TCP, non-ICMP, non-ICMPv6, non-SCTP, and non-UDP) floods?
type: boolean
red:
type: object
properties:
alarm_rate:
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
activate_rate:
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 10000
maximal_rate:
type: integer
format: int32
minimum: 0
maximum: 2000000
example: 40000
required:
- alarm_rate
- activate_rate
- maximal_rate
scan:
type: array
items:
type: object
properties:
name:
description: 'The threat ID number. These can be found in [Palo Alto Networks ThreatVault](https://threatvault.paloaltonetworks.com).
* "8001" - TCP Port Scan
* "8002" - Host Sweep
* "8003" - UDP Port Scan
* "8006" - Port Scan
'
type: string
enum:
- '8001'
- '8002'
- '8003'
- '8006'
action:
type: object
oneOf:
- title: allow
type: object
- title: alert
type: object
- title: block
type: object
- title: block_ip
type: object
properties:
track_by:
type: string
enum:
- source-and-destination
- source
duration:
type: integer
format: int32
minimum: 1
maximum: 3600
required:
- track_by
- duration
interval:
type: integer
format: int32
minimum: 2
maximum: 65535
example: 2
threshold:
type: integer
format: int32
minimum: 2
maximum: 65535
example: 100
required:
- name
scan_white_list:
type: array
items:
type: object
properties:
name:
description: A descriptive name for the address to exclude.
type: string
oneOf:
- title: ipv4
type: string
format: ipv4
- title: ipv6
type: string
format: ipv6
required:
- name
spoofed_ip_discard:
description: 'Check that the source IP address of the ingress packet is routable and the routing interface is in the same zone as the ingress interface. If either condition is not true, discard the packet.
'
type: boolean
strict_ip_check:
description: 'Check that both conditions are true:
* The source IP address is not the subnet broadcast IP address of the ingress interface.
* The source IP address is routable over the exact ingress interface.
If either condition is not true, discard the packet.
'
type: boolean
fragmented_traffic_discard:
description: 'Discard fragmented IP packets.
'
type: boolean
strict_source_routing_discard:
description: 'Discard packets with the Strict Source Routing IP option set. Strict Source Routing is an option whereby a source of a datagram provides routing information through which a gateway or host must send the datagram.
'
type: boolean
loose_source_routing_discard:
description: 'Discard packets with the Loose Source Routing IP option set. Loose Source Routing is an option whereby a source of a datagram provides routing information and a gateway or host is allowed to choose any route of a number of intermediate gateways to get the datagram to the next address in the route.
'
# --- truncated at 32 KB (46 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-zone-protection-profiles-api-openapi.yml