Palo Alto Prisma Access

OpenAPI spec for Palo Alto Prisma Access SASE configuration automation via API

Prisma Access is Palo Alto Networks' cloud-delivered SASE platform, providing network and security configuration (security policies, threat prevention profiles, remote networks, mobile users, and more) for a distributed workforce, managed via Strata Cloud Manager.

This project provides an OpenAPI spec for automating against Prisma Access's SASE configuration API via an Integration Model, plus a Studio Project of ready-to-import CRUD workflows built on that model.

Table of Contents

• Contents
• Requirements
• Integration Configuration
• OpenAPIs
  • palo_alto_prisma_access-latest.json
  • palo_alto_prisma_access-1.0.json
• Studio Projects
  • Palo Alto Prisma Access Project
    • Folder Structure
    • Dependencies

Contents

Requirements

Integration Configuration

Import palo_alto_prisma_access-latest.json as an Integration Model in Admin > Integrations, then create an integration pointing at Prisma Access's SASE API.

Authentication is OAuth 2.0 (client credentials grant), using an IAM service account's client ID/secret and your Tenant Service Group (TSG) ID as the scope. Set auth_method to client_secret_basic — Palo Alto's token endpoint requires HTTP Basic client credentials, not the alternate body-based method.

The instance's authentication/server properties should look like this once configured:

{
  "authentication": {
    "oauth2ClientCredentials": {
      "client_id": "<your-service-account-client-id>",
      "client_secret": "<your-service-account-client-secret>",
      "auth_method": "client_secret_basic",
      "scope": "tsg_id:<your-tenant-service-group-id>",
      "token_url": "https://auth.apps.paloaltonetworks.com/auth/v1/oauth2/access_token",
      "refresh_url": "",
      "token": { "access_token": "" }
    }
  },
  "server": {
    "protocol": "https",
    "host": "api.sase.paloaltonetworks.com",
    "base_path": ""
  }
}

OpenAPIs

palo_alto_prisma_access-latest.json

Covers all 344 operations across 68 resource categories.

Resources included, by category:

• Network & Security Objects: Addresses, Address Groups, Services, Service Groups, Applications, Application Groups/Filters, Tags, Regions, Schedules, External Dynamic Lists, Dynamic User Groups
• Security Policies & Rules: Security Rules, Decryption Rules, Application Override Rules, Traffic Steering Rules, QoS Policy Rules, Authentication Rules
• Threat Prevention Profiles: Anti-Spyware, Vulnerability Protection, WildFire Antivirus, File Blocking, DNS Security, Profile Groups
• Authentication & User Management: Authentication Profiles/Portals/Sequences, Local Users/Groups, LDAP/SAML/RADIUS/TACACS+/Kerberos/MFA server profiles
• Certificates & Encryption: Certificates, Certificate Profiles, Trusted CAs, Decryption Profiles/Exclusions, IKE Gateways/Crypto Profiles, IPSec Tunnels/Crypto Profiles, SCEP, OCSP Responder
• Application Control: URL Access Profiles, URL Categories, HIP Objects/Profiles
• Network Infrastructure: Remote Networks, Service Connections/Groups, Locations, Internal DNS Servers, Infrastructure Settings, Bandwidth Allocations, QoS Profiles
• Mobile Agent (GlobalProtect): agent profiles, tunnel profiles, authentication/infrastructure/global settings
• Other: Tags, HTTP Header Profiles, TLS Service Profiles, Auto Tag Actions, Quarantined Devices, Configuration Management (candidate push/versioning), License Types

Merging the 68 upstream files required resolving shared component definitions (parameter and response templates) referenced across files by the same name — where two files' definitions actually differed in content, the conflicting one was kept under a distinct name rather than silently overwritten.

palo_alto_prisma_access-1.0.json

Identical content to -latest.json — kept as the dated file per this repo's convention of always pairing a curated spec with a preserved original, even when the review found nothing to exclude. Version 1.0 matches the individual upstream resource specs' own declared version.

Studio Projects

Palo Alto Prisma Access Project

Backed by the Palo Alto Prisma Access:latest Integration Model (see palo_alto_prisma_access-latest.json above). The project contains 344 workflows organized into 68 folders, one per resource category.

Folder Structure

Dependencies