Configuration Orchestration API

openapi: 3.1.0
info:
  title: Palo Alto Networks SASE Configuration Orchestration API
  description: >-
    SASE Configuration Orchestration API for third-party SD-WAN integration.
    Enables SD-WAN partners and operators to programmatically manage remote
    network tunnel configurations, IKE gateway lifecycle, bandwidth
    allocations, and Prisma Access location data. Designed for integrating
    third-party SD-WAN solutions with Prisma Access for automated tunnel
    provisioning and management in branch office and remote network deployments.
    Requires partner integration credentials in addition to standard SASE
    OAuth 2.0 authentication.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.sase.paloaltonetworks.com/config-orchestration/v1
  description: SASE Configuration Orchestration API production server.
security:
- oauth2Bearer: []
tags:
- name: Bandwidth
  description: Bandwidth allocation visibility.
- name: Locations
  description: Prisma Access location data.
- name: Onboarding
  description: Remote network onboarding status.
- name: Remote Networks
  description: Remote network IPsec tunnel management.
paths:
  /remote-networks:
    get:
      operationId: listRemoteNetworks
      summary: Palo Alto Networks List Remote Networks
      description: >-
        Returns the list of remote network tunnel configurations for the
        tenant. Remote networks represent branch offices or data centers
        connected to Prisma Access via IPsec tunnels. Each entry includes
        the tunnel configuration, IKE gateway parameters, and current
        connection status.
      tags:
      - Remote Networks
      parameters:
      - name: location
        in: query
        description: Filter remote networks by Prisma Access location.
        schema:
          type: string
        example: example-location
      - name: status
        in: query
        description: Filter by tunnel connection status.
        schema:
          type: string
          enum:
          - connected
          - disconnected
          - pending
        example: disconnected
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of remote networks to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Remote networks returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/RemoteNetwork'
              examples:
                ListRemoteNetworks200Example:
                  summary: Default listRemoteNetworks 200 response
                  x-microcks-default: true
                  value:
                    total: 189
                    offset: 294
                    limit: 636
                    items:
                    - id: example-id
                      name: Production Agent 92
                      description: Firewall policy blocked endpoint suspicious suspicious endpoint monitoring monitoring alert Security Security.
                      location: example-location
                      subnets: &id001
                      - 10.66.40.0/24
                      ike_gateway:
                        peer_ip: example-peer_ip
                        peer_id: '176162'
                        local_ip: example-local_ip
                        ike_version: IKEv2
                        authentication_type: certificate
                      ipsec_tunnel:
                        local_address: example-local_address
                        remote_address: example-remote_address
                        tunnel_interface: example-tunnel_interface
                      tunnel_status: connected
                      bandwidth_mbps: 309
                      created_at: '2024-10-27T07:17:45Z'
                      updated_at: '2026-09-09T21:35:55Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRemoteNetworks400Example:
                  summary: Default listRemoteNetworks 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRemoteNetworks401Example:
                  summary: Default listRemoteNetworks 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRemoteNetworks403Example:
                  summary: Default listRemoteNetworks 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListRemoteNetworks500Example:
                  summary: Default listRemoteNetworks 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createRemoteNetwork
      summary: Palo Alto Networks Create Remote Network
      description: >-
        Creates a new remote network tunnel configuration. Provisions an
        IPsec tunnel between the specified branch location and the nearest
        Prisma Access gateway. The IKE gateway configuration is automatically
        generated unless custom parameters are provided.
      tags:
      - Remote Networks
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemoteNetworkRequest'
            examples:
              CreateRemoteNetworkRequestExample:
                summary: Default createRemoteNetwork request
                x-microcks-default: true
                value:
                  name: Primary Agent 21
                  description: Alert activity rule blocked firewall incident activity rule.
                  location: example-location
                  subnets: &id002
                  - 10.239.225.0/24
                  ike_gateway:
                    peer_ip: example-peer_ip
                    peer_id: '846951'
                    ike_version: IKEv2
                    authentication_type: pre-shared-key
                    pre_shared_key: example-pre_shared_key
                  bandwidth_mbps: 945
      responses:
        '201':
          description: Remote network created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                CreateRemoteNetwork201Example:
                  summary: Default createRemoteNetwork 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Production Agent 92
                    description: Firewall policy blocked endpoint suspicious suspicious endpoint monitoring monitoring alert Security Security.
                    location: example-location
                    subnets: *id001
                    ike_gateway:
                      peer_ip: example-peer_ip
                      peer_id: '176162'
                      local_ip: example-local_ip
                      ike_version: IKEv2
                      authentication_type: certificate
                    ipsec_tunnel:
                      local_address: example-local_address
                      remote_address: example-remote_address
                      tunnel_interface: example-tunnel_interface
                    tunnel_status: connected
                    bandwidth_mbps: 309
                    created_at: '2024-10-27T07:17:45Z'
                    updated_at: '2026-09-09T21:35:55Z'
        '400':
          description: Invalid request body or configuration.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork400Example:
                  summary: Default createRemoteNetwork 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork401Example:
                  summary: Default createRemoteNetwork 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork403Example:
                  summary: Default createRemoteNetwork 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '409':
          description: A remote network with this name already exists.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork409Example:
                  summary: Default createRemoteNetwork 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateRemoteNetwork500Example:
                  summary: Default createRemoteNetwork 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /remote-networks/{id}:
    get:
      operationId: getRemoteNetwork
      summary: Palo Alto Networks Get Remote Network
      description: Returns full details for a specific remote network tunnel configuration.
      tags:
      - Remote Networks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the remote network.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: Remote network details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                GetRemoteNetwork200Example:
                  summary: Default getRemoteNetwork 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Production Agent 92
                    description: Firewall policy blocked endpoint suspicious suspicious endpoint monitoring monitoring alert Security Security.
                    location: example-location
                    subnets: *id001
                    ike_gateway:
                      peer_ip: example-peer_ip
                      peer_id: '176162'
                      local_ip: example-local_ip
                      ike_version: IKEv2
                      authentication_type: certificate
                    ipsec_tunnel:
                      local_address: example-local_address
                      remote_address: example-remote_address
                      tunnel_interface: example-tunnel_interface
                    tunnel_status: connected
                    bandwidth_mbps: 309
                    created_at: '2024-10-27T07:17:45Z'
                    updated_at: '2026-09-09T21:35:55Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetRemoteNetwork401Example:
                  summary: Default getRemoteNetwork 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetRemoteNetwork403Example:
                  summary: Default getRemoteNetwork 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '404':
          description: Remote network not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetRemoteNetwork404Example:
                  summary: Default getRemoteNetwork 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetRemoteNetwork500Example:
                  summary: Default getRemoteNetwork 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateRemoteNetwork
      summary: Palo Alto Networks Update Remote Network
      description: Updates an existing remote network tunnel configuration.
      tags:
      - Remote Networks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the remote network to update.
        schema:
          type: string
        example: example-id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RemoteNetworkRequest'
            examples:
              UpdateRemoteNetworkRequestExample:
                summary: Default updateRemoteNetwork request
                x-microcks-default: true
                value:
                  name: Primary Agent 21
                  description: Alert activity rule blocked firewall incident activity rule.
                  location: example-location
                  subnets: *id002
                  ike_gateway:
                    peer_ip: example-peer_ip
                    peer_id: '846951'
                    ike_version: IKEv2
                    authentication_type: pre-shared-key
                    pre_shared_key: example-pre_shared_key
                  bandwidth_mbps: 945
      responses:
        '200':
          description: Remote network updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RemoteNetwork'
              examples:
                UpdateRemoteNetwork200Example:
                  summary: Default updateRemoteNetwork 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    name: Production Agent 92
                    description: Firewall policy blocked endpoint suspicious suspicious endpoint monitoring monitoring alert Security Security.
                    location: example-location
                    subnets: *id001
                    ike_gateway:
                      peer_ip: example-peer_ip
                      peer_id: '176162'
                      local_ip: example-local_ip
                      ike_version: IKEv2
                      authentication_type: certificate
                    ipsec_tunnel:
                      local_address: example-local_address
                      remote_address: example-remote_address
                      tunnel_interface: example-tunnel_interface
                    tunnel_status: connected
                    bandwidth_mbps: 309
                    created_at: '2024-10-27T07:17:45Z'
                    updated_at: '2026-09-09T21:35:55Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork400Example:
                  summary: Default updateRemoteNetwork 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork401Example:
                  summary: Default updateRemoteNetwork 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork403Example:
                  summary: Default updateRemoteNetwork 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '404':
          description: Remote network not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork404Example:
                  summary: Default updateRemoteNetwork 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateRemoteNetwork500Example:
                  summary: Default updateRemoteNetwork 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteRemoteNetwork
      summary: Palo Alto Networks Delete Remote Network
      description: >-
        Deletes a remote network tunnel configuration and tears down the
        associated IPsec tunnel.
      tags:
      - Remote Networks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the remote network to delete.
        schema:
          type: string
        example: example-id
      responses:
        '204':
          description: Remote network deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteRemoteNetwork401Example:
                  summary: Default deleteRemoteNetwork 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteRemoteNetwork403Example:
                  summary: Default deleteRemoteNetwork 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '404':
          description: Remote network not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteRemoteNetwork404Example:
                  summary: Default deleteRemoteNetwork 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteRemoteNetwork500Example:
                  summary: Default deleteRemoteNetwork 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /remote-networks/{id}/refresh-ike-gateway:
    post:
      operationId: refreshIKEGateway
      summary: Palo Alto Networks Refresh IKE Gateway
      description: >-
        Initiates an IKE gateway refresh for a remote network tunnel. Use
        this endpoint to re-establish an IPsec tunnel that has failed or
        to apply updated IKE parameters after a configuration change.
      tags:
      - Remote Networks
      parameters:
      - name: id
        in: path
        required: true
        description: Unique identifier of the remote network.
        schema:
          type: string
        example: example-id
      responses:
        '200':
          description: IKE gateway refresh initiated successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: Remote network identifier.
                  status:
                    type: string
                    enum:
                    - refreshing
                    description: Current refresh status.
                  initiated_at:
                    type: string
                    format: date-time
              examples:
                RefreshIkegateway200Example:
                  summary: Default refreshIKEGateway 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    status: refreshing
                    initiated_at: '2024-06-11T09:35:45Z'
        '400':
          description: Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway400Example:
                  summary: Default refreshIKEGateway 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway401Example:
                  summary: Default refreshIKEGateway 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway403Example:
                  summary: Default refreshIKEGateway 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '404':
          description: Remote network not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway404Example:
                  summary: Default refreshIKEGateway 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RefreshIkegateway500Example:
                  summary: Default refreshIKEGateway 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Configured activity investigation policy detected violation blocked.
                    request_id: 3ab20120-828b-4af3-9110-53521ee47614
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /bandwidth-allocations:
    get:
      operationId: getBandwidthAllocations
      summary: Palo Alto Networks Get Available Bandwidth Allocations
      description: >-
        Returns the available bandwidth allocations per Prisma Access
        location. Use this data to determine remaining capacity before
        creating remote network tunnels or to monitor utilization against
        licensed bandwidth.
      tags:
      - Bandwidth
      parameters:
      - name: location
        in: query
        description: Filter by specific Prisma Access location name.
        schema:
          type: string
        example: example-location
      responses:
        '200':
          description: Bandwidth allocations returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/BandwidthAllocation'
              examples:
                GetBandwidthAllocations200Example:
                  summary: Default getBandwidthAllocations 200 response
                  x-microcks-default: true
                  value:
                    total: 75
                    items:
                    - location: example-location
                      region: us-east-1
                      licensed_bandwidth_mbps: 771
                      allocated_bandwidth_mbps: 191
                      available_bandwidth_mbps: 791
                    - location: example-location
                      region: us-east-1
                      licensed_bandwidth_mbps: 771
                      allocated_bandwidth_mbps: 191
     

# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-sase-config-orchestration-api-openapi-original.yml