Prisma Access API

openapi: 3.1.0
info:
  title: Palo Alto Networks Prisma Access Configuration API
  description: >-
    REST API for the Prisma Access SASE platform providing programmatic
    configuration of remote networks, service connections, mobile user
    infrastructure settings, IKE gateways, IPSec tunnels, and security
    rules. Prisma Access delivers cloud-delivered security for branch
    offices, retail locations, and mobile users. All configuration changes
    are staged in a candidate configuration and must be explicitly pushed
    using the candidate push endpoint to take effect. Supports OAuth 2.0
    Bearer token authentication.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.sase.paloaltonetworks.com/sse/config/v1
  description: Prisma Access SASE configuration API server.
security:
- oauth2: []
tags:
- name: Configuration
  description: >-
    Candidate configuration management and job tracking.
- name: IKEGateways
  description: >-
    IKE gateway configuration for establishing IPSec VPN tunnels
    to Prisma Access.
- name: IPSecTunnels
  description: >-
    IPSec tunnel configuration for site-to-site VPN connectivity.
- name: MobileAgent
  description: >-
    Mobile user agent infrastructure settings for GlobalProtect
    remote user connectivity.
- name: RemoteNetworks
  description: >-
    Remote network configuration for connecting branch offices and
    data centers to Prisma Access via IPSec tunnels.
- name: SecurityRules
  description: >-
    Security policy rule management for controlling traffic
    flowing through Prisma Access.
- name: ServiceConnections
  description: >-
    Service connection management for providing access to internal
    resources through Prisma Access.
paths:
  /remote-networks:
    get:
      operationId: listRemoteNetworks
      summary: Palo Alto Networks List Remote Networks
      description: >-
        Returns a list of all configured remote networks in the Prisma
        Access tenant. Each remote network represents a branch or data
        center site connected via IPSec tunnel. Supports filtering by
        name and folder, with pagination.
      tags:
      - RemoteNetworks
      parameters:
      - name: folder
        in: query
        description: Filter remote networks by folder (e.g., Remote Networks).
        schema:
          type: string
        example: example-folder
      - name: name
        in: query
        description: Filter by remote network name.
        schema:
          type: string
        example: Production Firewall 82
      - name: offset
        in: query
        description: Starting offset for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of results to return.
        schema:
          type: integer
          default: 200
          maximum: 5000
        example: 200
      responses:
        '200':
          description: Remote networks returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/RemoteNetwork'
                  offset:
                    type: integer
                  total:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListRemoteNetworks200Example:
                  summary: Default listRemoteNetworks 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: example-id
                      name: Corporate Sensor 34
                      region: us-west-2
                      license_type: FWAAS-AGGREGATE
                      spn_name: Production Gateway 60
                      ecmp_load_balancing: disable
                      subnets: &id001
                      - 10.231.109.0/24
                      - 10.117.88.0/24
                      folder: example-folder
                    - id: example-id
                      name: Corporate Sensor 34
                      region: us-west-2
                      license_type: FWAAS-AGGREGATE
                      spn_name: Production Gateway 60
                      ecmp_load_balancing: disable
                      subnets: *id001
                      folder: example-folder
                    offset: 310
                    total: 460
                    limit: 429
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createRemoteNetwork
      summary: Palo Alto Networks Create a Remote Network
      description: >-
        Creates a new remote network configuration in the candidate
        configuration. The remote network defines an IPSec tunnel
        endpoint for connecting a branch office or data center to
        Prisma Access. Changes must be pushed to take effect.
      tags:
      - RemoteNetworks
      parameters:
      - name: folder
        in: query
        required: true
        description: Target folder for the remote network (e.g., Remote Networks).
        schema:
          type: string
        example: example-folder
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemoteNetwork'
            examples:
              CreateRemoteNetworkRequestExample:
                summary: Default createRemoteNetwork request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Corporate Sensor 34
                  region: us-west-2
                  license_type: FWAAS-AGGREGATE
                  spn_name: Production Gateway 60
                  ecmp_load_balancing: disable
                  subnets: *id001
                  folder: example-folder
      responses:
        '201':
          description: Remote network created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                CreateRemoteNetwork201Example:
                  summary: Default createRemoteNetwork 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Corporate Sensor 34
                    region: us-west-2
                    license_type: FWAAS-AGGREGATE
                    spn_name: Production Gateway 60
                    ecmp_load_balancing: disable
                    subnets: *id001
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /remote-networks/{id}:
    get:
      operationId: getRemoteNetwork
      summary: Palo Alto Networks Get a Remote Network
      description: Returns the configuration of a specific remote network by ID.
      tags:
      - RemoteNetworks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique remote network identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Remote network returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                GetRemoteNetwork200Example:
                  summary: Default getRemoteNetwork 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Corporate Sensor 34
                    region: us-west-2
                    license_type: FWAAS-AGGREGATE
                    spn_name: Production Gateway 60
                    ecmp_load_balancing: disable
                    subnets: *id001
                    folder: example-folder
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateRemoteNetwork
      summary: Palo Alto Networks Update a Remote Network
      description: >-
        Updates the configuration of an existing remote network in the
        candidate configuration. Changes must be pushed to take effect.
      tags:
      - RemoteNetworks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique remote network identifier.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemoteNetwork'
            examples:
              UpdateRemoteNetworkRequestExample:
                summary: Default updateRemoteNetwork request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Corporate Sensor 34
                  region: us-west-2
                  license_type: FWAAS-AGGREGATE
                  spn_name: Production Gateway 60
                  ecmp_load_balancing: disable
                  subnets: *id001
                  folder: example-folder
      responses:
        '200':
          description: Remote network updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                UpdateRemoteNetwork200Example:
                  summary: Default updateRemoteNetwork 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Corporate Sensor 34
                    region: us-west-2
                    license_type: FWAAS-AGGREGATE
                    spn_name: Production Gateway 60
                    ecmp_load_balancing: disable
                    subnets: *id001
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteRemoteNetwork
      summary: Palo Alto Networks Delete a Remote Network
      description: >-
        Deletes a remote network from the candidate configuration.
        Changes must be pushed to take effect.
      tags:
      - RemoteNetworks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique remote network identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Remote network deleted successfully.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /service-connections:
    get:
      operationId: listServiceConnections
      summary: Palo Alto Networks List Service Connections
      description: >-
        Returns a list of all configured service connections. Service
        connections provide access to internal data center resources
        from Prisma Access through dedicated IPSec tunnels.
      tags:
      - ServiceConnections
      parameters:
      - name: folder
        in: query
        description: Filter by folder.
        schema:
          type: string
        example: example-folder
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 200
        example: 200
      responses:
        '200':
          description: Service connections returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ServiceConnection'
                  offset:
                    type: integer
                  total:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListServiceConnections200Example:
                  summary: Default listServiceConnections 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: example-id
                      name: Branch Sensor 44
                      region: us-west-2
                      ipsec_tunnel: example-ipsec_tunnel
                      subnets: &id002
                      - 10.241.132.0/24
                      - 10.82.85.0/24
                      nat_pool: example-nat_pool
                      qos_enabled: false
                      folder: example-folder
                    - id: example-id
                      name: Branch Sensor 44
                      region: us-west-2
                      ipsec_tunnel: example-ipsec_tunnel
                      subnets: *id002
                      nat_pool: example-nat_pool
                      qos_enabled: false
                      folder: example-folder
                    offset: 852
                    total: 192
                    limit: 331
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createServiceConnection
      summary: Palo Alto Networks Create a Service Connection
      description: >-
        Creates a new service connection in the candidate configuration.
        Changes must be pushed to take effect.
      tags:
      - ServiceConnections
      parameters:
      - name: folder
        in: query
        required: true
        description: Target folder for the service connection.
        schema:
          type: string
        example: example-folder
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceConnection'
            examples:
              CreateServiceConnectionRequestExample:
                summary: Default createServiceConnection request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 44
                  region: us-west-2
                  ipsec_tunnel: example-ipsec_tunnel
                  subnets: *id002
                  nat_pool: example-nat_pool
                  qos_enabled: false
                  folder: example-folder
      responses:
        '201':
          description: Service connection created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceConnection'
              examples:
                CreateServiceConnection201Example:
                  summary: Default createServiceConnection 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 44
                    region: us-west-2
                    ipsec_tunnel: example-ipsec_tunnel
                    subnets: *id002
                    nat_pool: example-nat_pool
                    qos_enabled: false
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /service-connections/{id}:
    get:
      operationId: getServiceConnection
      summary: Palo Alto Networks Get a Service Connection
      description: Returns the configuration of a specific service connection.
      tags:
      - ServiceConnections
      parameters:
      - name: id
        in: path
        required: true
        description: Unique service connection identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Service connection returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceConnection'
              examples:
                GetServiceConnection200Example:
                  summary: Default getServiceConnection 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 44
                    region: us-west-2
                    ipsec_tunnel: example-ipsec_tunnel
                    subnets: *id002
                    nat_pool: example-nat_pool
                    qos_enabled: false
                    folder: example-folder
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateServiceConnection
      summary: Palo Alto Networks Update a Service Connection
      description: Updates an existing service connection in the candidate configuration.
      tags:
      - ServiceConnections
      parameters:
      - name: id
        in: path
        required: true
        description: Unique service connection identifier.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ServiceConnection'
            examples:
              UpdateServiceConnectionRequestExample:
                summary: Default updateServiceConnection request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 44
                  region: us-west-2
                  ipsec_tunnel: example-ipsec_tunnel
                  subnets: *id002
                  nat_pool: example-nat_pool
                  qos_enabled: false
                  folder: example-folder
      responses:
        '200':
          description: Service connection updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ServiceConnection'
              examples:
                UpdateServiceConnection200Example:
                  summary: Default updateServiceConnection 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 44
                    region: us-west-2
                    ipsec_tunnel: example-ipsec_tunnel
                    subnets: *id002
                    nat_pool: example-nat_pool
                    qos_enabled: false
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteServiceConnection
      summary: Palo Alto Networks Delete a Service Connection
      description: Deletes a service connection from the candidate configuration.
      tags:
      - ServiceConnections
      parameters:
      - name: id
        in: path
        required: true
        description: Unique service connection identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Service connection deleted successfully.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /mobile-agent/infrastructure-settings:
    get:
      operationId: getMobileAgentInfrastructureSettings
      summary: Palo Alto Networks Get Mobile Agent Infrastructure Settings
      description: >-
        Returns the mobile user infrastructure settings for GlobalProtect
        agent connectivity. These settings define the Prisma Access compute
        locations, IP pool allocations, and portal configuration for
        remote mobile users.
      tags:
      - MobileAgent
      parameters:
      - name: folder
        in: query
        description: Filter by folder (e.g., Mobile Users).
        schema:
          type: string
        example: example-folder
      responses:
        '200':
          description: Mobile agent infrastructure settings returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MobileAgentInfrastructureSettings'
              examples:
                GetMobileAgentInfrastructureSettings200Example:
                  summary: Default getMobileAgentInfrastructureSettings 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 52
                    ip_pool: &id003
                    - example-ip_pool_item
                    - example-ip_pool_item
                    dns_servers: &id004
                    - example-dns_servers_item
                    dns_suffix: &id005
                    - example-dns_suffix_item
                    regions: &id006
                    - name: Production Firewall 52
                      addresses:
                      - example-addresses_item
                      - example-addresses_item
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createMobileAgentInfrastructureSettings
      summary: Palo Alto Networks Create Mobile Agent Infrastructure Settings
      description: >-
        Creates or updates the mobile user infrastructure settings in
        the candidate configuration. Changes must be pushed to take
        effect.
      tags:
      - MobileAgent
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MobileAgentInfrastructureSettings'
            examples:
              CreateMobileAgentInfrastructureSettingsRequestExample:
                summary: Default createMobileAgentInfrastructureSettings request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 52
                  ip_pool: *id003
                  dns_servers: *id004
                  dns_suffix: *id005
                  regions: *id006
      responses:
        '200':
          description: Mobile agent infrastructure settings saved successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MobileAgentInfrastructureSettings'
              examples:
                CreateMobileAgentInfrastructureSettings200Example:
                  summary: Default createMobileAgentInfrastructureSettings 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 52
                    ip_pool: *id003
                    dns_servers: *id004
                    dns_suffix: *id005
                    regions: *id006
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /ike-gateways:
    get:
      operationId: listIKEGateways
      summary: Palo Alto Networks List IKE Gateways
      description: >-
        Returns a list of IKE gateway configurations. IKE gateways define
        the parameters for establishing the IKE phase 1 negotiation used
        by IPSec VPN tunnels connecting to Prisma Access.
      tags:
      - IKEGateways
      parameters:
      - name: folder
        in: query
        description: Filter by folder.
        schema:
          type: string
        example: example-folder
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 200
        example: 200
      responses:
        '200':
          description: IKE gateways returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/IKEGateway'
                  offset:
                    type: integer
                  total:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListIkegateways200Example:
                  summary: Default listIKEGateways 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - id: example-id
                      name: Branch Sensor 55
                      version: ikev2-preferred
                      peer_address: &id007
                        ip: 10.213.81.33
                        dynamic: true
                      authentication: &id008
                        pre_shared_key: example-pre_shared_key
                        certificate:
                          local_certificate: example-local_certificate
                      local_id: &id009
                        type: fqdn
                        id: example-id
                      peer_id: &id010
                        type: ufqdn
                        id: example-id
                      folder: example-folder
                    - id: example-id
                      name: Branch Sensor 55
                      version: ikev2-preferred
                      peer_address: *id007
                      authentication: *id008
                      local_id: *id009
                      peer_id: *id010
                      folder: example-folder
                    offset: 969
                    total: 242
                    limit: 163
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createIKEGateway
      summary: Palo Alto Networks Create an IKE Gateway
      description: Creates a new IKE gateway in the candidate configuration.
      tags:
      - IKEGateways
      parameters:
      - name: folder
        in: query
        required: true
        description: Target folder for the IKE gateway.
        schema:
          type: string
        example: example-folder
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IKEGateway'
            examples:
              CreateIkegatewayRequestExample:
                summary: Default createIKEGateway request
                x-microcks-default: true
                value:
                  id: example-id
                  name: Branch Sensor 55
                  version: ikev2-preferred
                  peer_address: *id007
                  authentication: *id008
                  local_id: *id009
                  peer_id: *id010
                  folder: example-folder
      responses:
        '201':
          description: IKE gateway created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IKEGateway'
              examples:
                CreateIkegateway201Example:
                  summary: Default createIKEGateway 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 55
                    version: ikev2-preferred
                    peer_address: *id007
                    authentication: *id008
                    local_id: *id009
                    peer_id: *id010
                    folder: example-folder
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /ike-gateways/{id}:
    get:
      operationId: getIKEGateway
      summary: Palo Alto Networks Get an IKE Gateway
      description: Returns the configuration of a specific IKE gateway.
      tags:
      - IKEGateways
      parameters:
      - name: id
        in: path
        required: true
        description: Unique IKE gateway identifier.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: IKE gateway returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IKEGateway'
              examples:
                GetIkegateway200Example:
                  summary: Default getIKEGateway 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Branch Sensor 55
                    version: ikev2-preferred
                    peer_address: *id007
                    authentication: *id008
                    local_id: *id009
                    peer_id: *id010
      

# --- truncated at 32 KB (76 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-prisma-access-api-openapi-original.yml