PAN-OS REST API

openapi: 3.1.0
info:
  title: Palo Alto Networks PAN-OS REST API
  description: >-
    RESTful API for managing Palo Alto Networks PAN-OS next-generation
    firewalls. Provides programmatic access to configure firewall policies,
    objects, network interfaces, and device settings. The API follows a
    resource-oriented design with standard HTTP methods for CRUD operations.
    Authentication uses an API key passed in the X-PAN-KEY header, generated
    from the PAN-OS web interface under Device > Administrators or via the
    /api/?type=keygen XML API endpoint. All configuration changes are staged
    in candidate configuration and require a commit to take effect.
  version: '10.2'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/pan-os/docs/restapi/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://{firewall}/restapi/v10.2
  description: PAN-OS firewall or Panorama REST API endpoint.
  variables:
    firewall:
      description: Hostname or IP address of the PAN-OS firewall or Panorama appliance.
      default: firewall.example.com
security:
- apiKey: []
tags:
- name: Commit
  description: Configuration commit operations.
- name: Device
  description: Device system information and virtual system management.
- name: Objects
  description: >-
    Address objects, address groups, service objects, service groups, and
    tag management.
- name: Policies
  description: Security policy rules, NAT rules, and QoS rule management.
paths:
  /Objects/Addresses:
    get:
      operationId: listAddresses
      summary: Palo Alto Networks List Address Objects
      description: >-
        Returns all address objects configured on the firewall. Supports
        filtering by name and location (vsys, device group, or shared).
        Address objects define IP addresses, IP ranges, IP subnets, or FQDNs
        used in security policy rules.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by address object name.
        schema:
          type: string
        example: Production Firewall 09
      responses:
        '200':
          description: Address objects returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                    example: success
                  '@code':
                    type: string
                    example: '19'
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/Address'
              examples:
                ListAddresses200Example:
                  summary: Default listAddresses 200 response
                  x-microcks-default: true
                  value:
                    '@status': success
                    '@code': '19'
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Production Firewall 76
                        ip-netmask: example-ip-netmask
                        ip-range: example-ip-range
                        ip-wildcard: example-ip-wildcard
                        fqdn: api.acme-systems.org
                        description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                        tag: &id001
                          member:
                          - example-member_item
                          - example-member_item
                      - '@name': Production Firewall 76
                        ip-netmask: example-ip-netmask
                        ip-range: example-ip-range
                        ip-wildcard: example-ip-wildcard
                        fqdn: api.acme-systems.org
                        description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                        tag: *id001
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createAddress
      summary: Palo Alto Networks Create Address Object
      description: >-
        Creates a new address object on the firewall. The address object can
        be of type ip-netmask, ip-range, ip-wildcard, or fqdn. The object must
        have a unique name within the specified location scope. Changes are
        staged in candidate configuration until committed.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address object to create.
        schema:
          type: string
        example: Staging Policy 66
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Address'
            examples:
              CreateAddressRequestExample:
                summary: Default createAddress request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Production Firewall 76
                    ip-netmask: example-ip-netmask
                    ip-range: example-ip-range
                    ip-wildcard: example-ip-wildcard
                    fqdn: api.acme-systems.org
                    description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                    tag: *id001
      responses:
        '200':
          description: Address object created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateAddress200Example:
                  summary: Default createAddress 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          description: Address object with the specified name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAddress409Example:
                  summary: Default createAddress 409 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    msg: &id002
                      line: example-line
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateAddress
      summary: Palo Alto Networks Update Address Object
      description: >-
        Updates an existing address object identified by name. The entire
        object definition must be provided in the request body as this
        performs a full replacement of the address object configuration.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address object to update.
        schema:
          type: string
        example: Branch Agent 74
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Address'
            examples:
              UpdateAddressRequestExample:
                summary: Default updateAddress request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Production Firewall 76
                    ip-netmask: example-ip-netmask
                    ip-range: example-ip-range
                    ip-wildcard: example-ip-wildcard
                    fqdn: api.acme-systems.org
                    description: Blocked malware incident monitoring configured threat activity violation monitoring threat detected.
                    tag: *id001
      responses:
        '200':
          description: Address object updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateAddress200Example:
                  summary: Default updateAddress 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteAddress
      summary: Palo Alto Networks Delete Address Object
      description: >-
        Deletes an address object identified by name. The object cannot be
        deleted if it is referenced by an active security policy rule or
        address group. Remove all references before deleting.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address object to delete.
        schema:
          type: string
        example: Production Agent 38
      responses:
        '200':
          description: Address object deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteAddress200Example:
                  summary: Default deleteAddress 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          description: Object is referenced by other configuration elements.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteAddress409Example:
                  summary: Default deleteAddress 409 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    msg: *id002
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/AddressGroups:
    get:
      operationId: listAddressGroups
      summary: Palo Alto Networks List Address Groups
      description: >-
        Returns all address groups configured on the firewall. Address groups
        contain address objects or other address groups and can be static
        (explicit member list) or dynamic (tag-based membership criteria).
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by address group name.
        schema:
          type: string
        example: Corporate Sensor 37
      responses:
        '200':
          description: Address groups returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/AddressGroup'
              examples:
                ListAddressGroups200Example:
                  summary: Default listAddressGroups 200 response
                  x-microcks-default: true
                  value:
                    '@status': enabled
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Branch Agent 57
                        static: &id003
                          member:
                          - example-member_item
                        dynamic: &id004
                          filter: example-filter
                        description: Policy alert detected violation network network violation suspicious on malware network.
                        tag: &id005
                          member:
                          - example-member_item
                          - example-member_item
                      - '@name': Branch Agent 57
                        static: *id003
                        dynamic: *id004
                        description: Policy alert detected violation network network violation suspicious on malware network.
                        tag: *id005
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createAddressGroup
      summary: Palo Alto Networks Create Address Group
      description: >-
        Creates a new address group. The group can be static with an explicit
        list of member address objects, or dynamic with a tag-based filter
        expression that automatically includes matching address objects.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address group to create.
        schema:
          type: string
        example: Primary Policy 55
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/AddressGroup'
            examples:
              CreateAddressGroupRequestExample:
                summary: Default createAddressGroup request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Branch Agent 57
                    static: *id003
                    dynamic: *id004
                    description: Policy alert detected violation network network violation suspicious on malware network.
                    tag: *id005
      responses:
        '200':
          description: Address group created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateAddressGroup200Example:
                  summary: Default createAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '409':
          description: Address group with the specified name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateAddressGroup409Example:
                  summary: Default createAddressGroup 409 response
                  x-microcks-default: true
                  value:
                    '@status': running
                    '@code': example-@code
                    msg: *id002
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateAddressGroup
      summary: Palo Alto Networks Update Address Group
      description: >-
        Updates an existing address group identified by name. The entire group
        definition must be provided as this performs a full replacement.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address group to update.
        schema:
          type: string
        example: Branch Agent 78
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/AddressGroup'
            examples:
              UpdateAddressGroupRequestExample:
                summary: Default updateAddressGroup request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Branch Agent 57
                    static: *id003
                    dynamic: *id004
                    description: Policy alert detected violation network network violation suspicious on malware network.
                    tag: *id005
      responses:
        '200':
          description: Address group updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateAddressGroup200Example:
                  summary: Default updateAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteAddressGroup
      summary: Palo Alto Networks Delete Address Group
      description: Deletes an address group identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the address group to delete.
        schema:
          type: string
        example: Primary Gateway 21
      responses:
        '200':
          description: Address group deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteAddressGroup200Example:
                  summary: Default deleteAddressGroup 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/Services:
    get:
      operationId: listServices
      summary: Palo Alto Networks List Service Objects
      description: >-
        Returns all service objects configured on the firewall. Service objects
        define TCP or UDP protocol and port combinations used in security policy
        rules to identify specific network services.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by service object name.
        schema:
          type: string
        example: Primary Gateway 90
      responses:
        '200':
          description: Service objects returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/Service'
              examples:
                ListServices200Example:
                  summary: Default listServices 200 response
                  x-microcks-default: true
                  value:
                    '@status': active
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Staging Firewall 44
                        protocol: &id006
                          tcp:
                            port: example-port
                            source-port: example-source-port
                          udp:
                            port: example-port
                            source-port: example-source-port
                        description: On endpoint traffic rule alert blocked.
                        tag: &id007
                          member:
                          - example-member_item
                          - example-member_item
                      - '@name': Staging Firewall 44
                        protocol: *id006
                        description: On endpoint traffic rule alert blocked.
                        tag: *id007
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createService
      summary: Palo Alto Networks Create Service Object
      description: >-
        Creates a new service object defining a TCP or UDP protocol with
        destination port or port range.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service object to create.
        schema:
          type: string
        example: Corporate Sensor 55
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Service'
            examples:
              CreateServiceRequestExample:
                summary: Default createService request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Staging Firewall 44
                    protocol: *id006
                    description: On endpoint traffic rule alert blocked.
                    tag: *id007
      responses:
        '200':
          description: Service object created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                CreateService200Example:
                  summary: Default createService 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateService
      summary: Palo Alto Networks Update Service Object
      description: Updates an existing service object identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service object to update.
        schema:
          type: string
        example: Branch Gateway 83
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/Service'
            examples:
              UpdateServiceRequestExample:
                summary: Default updateService request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Staging Firewall 44
                    protocol: *id006
                    description: On endpoint traffic rule alert blocked.
                    tag: *id007
      responses:
        '200':
          description: Service object updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                UpdateService200Example:
                  summary: Default updateService 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteService
      summary: Palo Alto Networks Delete Service Object
      description: Deletes a service object identified by name.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service object to delete.
        schema:
          type: string
        example: Staging Agent 83
      responses:
        '200':
          description: Service object deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'
              examples:
                DeleteService200Example:
                  summary: Default deleteService 200 response
                  x-microcks-default: true
                  value:
                    '@status': error
                    '@code': example-@code
                    msg: example-msg
        '400':
          $ref: '#/components/responses/BadRequest'
        '404':
          $ref: '#/components/responses/NotFound'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /Objects/ServiceGroups:
    get:
      operationId: listServiceGroups
      summary: Palo Alto Networks List Service Groups
      description: >-
        Returns all service groups configured on the firewall. Service groups
        aggregate multiple service objects for use in security policy rules.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        description: Filter by service group name.
        schema:
          type: string
        example: Corporate Sensor 06
      responses:
        '200':
          description: Service groups returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  '@status':
                    type: string
                  '@code':
                    type: string
                  result:
                    type: object
                    properties:
                      '@total-count':
                        type: string
                      '@count':
                        type: string
                      entry:
                        type: array
                        items:
                          $ref: '#/components/schemas/ServiceGroup'
              examples:
                ListServiceGroups200Example:
                  summary: Default listServiceGroups 200 response
                  x-microcks-default: true
                  value:
                    '@status': active
                    '@code': example-@code
                    result:
                      '@total-count': example-@total-count
                      '@count': example-@count
                      entry:
                      - '@name': Primary Policy 84
                        members: &id008
                          member:
                          - example-member_item
                          - example-member_item
                        tag: &id009
                          member:
                          - example-member_item
                      - '@name': Primary Policy 84
                        members: *id008
                        tag: *id009
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createServiceGroup
      summary: Palo Alto Networks Create Service Group
      description: Creates a new service group containing one or more service objects.
      tags:
      - Objects
      parameters:
      - $ref: '#/components/parameters/location'
      - $ref: '#/components/parameters/vsys'
      - name: name
        in: query
        required: true
        description: Name of the service group to create.
        schema:
          type: string
        example: Staging Policy 14
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                entry:
                  $ref: '#/components/schemas/ServiceGroup'
            examples:
              CreateServiceGroupRequestExample:
                summary: Default createServiceGroup request
                x-microcks-default: true
                value:
                  entry:
                    '@name': Primary Policy 84
                    members: *id008
                    tag: *id009
      responses:
        '200':
          description: Service group created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PanOsResponse'


# --- truncated at 32 KB (100 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-pan-os-rest-api-openapi-original.yml