SASE Tenancy Service API

openapi: 3.1.0
info:
  title: Palo Alto Networks SASE Tenancy Service API
  description: >-
    SASE Tenancy Service API for Tenant Service Group (TSG) management.
    Provides programmatic control over the multi-tenant hierarchy used in
    Palo Alto Networks SASE deployments. Tenant Service Groups are the
    organizational units used to scope SASE policies, licenses, and
    administrative access. Supports creating parent and child TSG
    relationships to model managed service provider and enterprise
    sub-tenant structures.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.sase.paloaltonetworks.com/tenancy/v1
  description: SASE Tenancy Service API production server.
security:
- oauth2Bearer: []
tags:
- name: Tenant Service Groups
  description: Tenant Service Group lifecycle management and hierarchy queries.
paths:
  /tenant-service-groups:
    get:
      operationId: listTenantServiceGroups
      summary: Palo Alto Networks List Tenant Service Groups
      description: >-
        Returns the list of Tenant Service Groups accessible to the
        authenticated service account. Results include the TSG hierarchy
        metadata, license counts, and current status. Supports filtering
        and pagination for tenants managing large numbers of TSGs.
      tags:
      - Tenant Service Groups
      parameters:
      - name: parent_id
        in: query
        description: Filter to return only direct children of the specified TSG ID.
        schema:
          type: string
        example: '182341'
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of TSGs to return per page.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Tenant Service Groups returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of TSGs matching the query.
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                ListTenantServiceGroups200Example:
                  summary: Default listTenantServiceGroups 200 response
                  x-microcks-default: true
                  value:
                    total: 242
                    offset: 963
                    limit: 823
                    items:
                    - id: example-id
                      display_name: Carlos Chen
                      description: Traffic threat traffic detected detected on.
                      parent_id: '413395'
                      support_account_id: '979872'
                      vertical: example-vertical
                      region: eu-west-1
                      status: active
                      child_count: 782
                      created_at: '2024-11-10T07:08:17Z'
                      updated_at: '2026-12-02T12:47:54Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListTenantServiceGroups400Example:
                  summary: Default listTenantServiceGroups 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListTenantServiceGroups401Example:
                  summary: Default listTenantServiceGroups 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListTenantServiceGroups403Example:
                  summary: Default listTenantServiceGroups 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListTenantServiceGroups500Example:
                  summary: Default listTenantServiceGroups 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createTenantServiceGroup
      summary: Palo Alto Networks Create Tenant Service Group
      description: >-
        Creates a new Tenant Service Group. A parent TSG ID must be
        provided to place the new TSG within the hierarchy. The creating
        account must have administrative access to the parent TSG.
      tags:
      - Tenant Service Groups
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TenantServiceGroupRequest'
            examples:
              CreateTenantServiceGroupRequestExample:
                summary: Default createTenantServiceGroup request
                x-microcks-default: true
                value:
                  display_name: John Kumar
                  description: Activity activity alert investigation configured policy blocked rule monitoring configured alert Security.
                  parent_id: '266024'
                  support_account_id: '233774'
                  vertical: example-vertical
                  region: eu-west-1
      responses:
        '201':
          description: Tenant Service Group created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                CreateTenantServiceGroup201Example:
                  summary: Default createTenantServiceGroup 201 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    display_name: Carlos Chen
                    description: Traffic threat traffic detected detected on.
                    parent_id: '413395'
                    support_account_id: '979872'
                    vertical: example-vertical
                    region: eu-west-1
                    status: active
                    child_count: 782
                    created_at: '2024-11-10T07:08:17Z'
                    updated_at: '2026-12-02T12:47:54Z'
        '400':
          description: Invalid request body or missing required fields.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup400Example:
                  summary: Default createTenantServiceGroup 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup401Example:
                  summary: Default createTenantServiceGroup 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions on the parent TSG.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup403Example:
                  summary: Default createTenantServiceGroup 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '409':
          description: A TSG with this name already exists under the parent.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup409Example:
                  summary: Default createTenantServiceGroup 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateTenantServiceGroup500Example:
                  summary: Default createTenantServiceGroup 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /tenant-service-groups/{tsg_id}:
    get:
      operationId: getTenantServiceGroup
      summary: Palo Alto Networks Get Tenant Service Group Details
      description: >-
        Returns full details for a specific Tenant Service Group including
        its parent, display name, description, license allocations, and
        current status.
      tags:
      - Tenant Service Groups
      parameters:
      - name: tsg_id
        in: path
        required: true
        description: Unique identifier of the Tenant Service Group.
        schema:
          type: string
        example: '725984'
      responses:
        '200':
          description: Tenant Service Group details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                GetTenantServiceGroup200Example:
                  summary: Default getTenantServiceGroup 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    display_name: Carlos Chen
                    description: Traffic threat traffic detected detected on.
                    parent_id: '413395'
                    support_account_id: '979872'
                    vertical: example-vertical
                    region: eu-west-1
                    status: active
                    child_count: 782
                    created_at: '2024-11-10T07:08:17Z'
                    updated_at: '2026-12-02T12:47:54Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetTenantServiceGroup401Example:
                  summary: Default getTenantServiceGroup 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetTenantServiceGroup403Example:
                  summary: Default getTenantServiceGroup 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '404':
          description: Tenant Service Group not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetTenantServiceGroup404Example:
                  summary: Default getTenantServiceGroup 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetTenantServiceGroup500Example:
                  summary: Default getTenantServiceGroup 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateTenantServiceGroup
      summary: Palo Alto Networks Update Tenant Service Group
      description: >-
        Updates the display name, description, or contact information for
        an existing Tenant Service Group. The TSG ID and parent relationship
        cannot be changed after creation.
      tags:
      - Tenant Service Groups
      parameters:
      - name: tsg_id
        in: path
        required: true
        description: Unique identifier of the Tenant Service Group to update.
        schema:
          type: string
        example: '507202'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TenantServiceGroupUpdate'
            examples:
              UpdateTenantServiceGroupRequestExample:
                summary: Default updateTenantServiceGroup request
                x-microcks-default: true
                value:
                  display_name: Carlos Wilson
                  description: Policy suspicious policy firewall alert network policy.
                  vertical: example-vertical
      responses:
        '200':
          description: Tenant Service Group updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                UpdateTenantServiceGroup200Example:
                  summary: Default updateTenantServiceGroup 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    display_name: Carlos Chen
                    description: Traffic threat traffic detected detected on.
                    parent_id: '413395'
                    support_account_id: '979872'
                    vertical: example-vertical
                    region: eu-west-1
                    status: active
                    child_count: 782
                    created_at: '2024-11-10T07:08:17Z'
                    updated_at: '2026-12-02T12:47:54Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup400Example:
                  summary: Default updateTenantServiceGroup 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup401Example:
                  summary: Default updateTenantServiceGroup 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup403Example:
                  summary: Default updateTenantServiceGroup 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '404':
          description: Tenant Service Group not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup404Example:
                  summary: Default updateTenantServiceGroup 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateTenantServiceGroup500Example:
                  summary: Default updateTenantServiceGroup 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteTenantServiceGroup
      summary: Palo Alto Networks Delete Tenant Service Group
      description: >-
        Deletes a Tenant Service Group. The TSG must have no child TSGs
        and no active service subscriptions before deletion. This action
        is irreversible.
      tags:
      - Tenant Service Groups
      parameters:
      - name: tsg_id
        in: path
        required: true
        description: Unique identifier of the Tenant Service Group to delete.
        schema:
          type: string
        example: '214309'
      responses:
        '204':
          description: Tenant Service Group deleted successfully.
        '400':
          description: TSG has child TSGs or active subscriptions and cannot be deleted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup400Example:
                  summary: Default deleteTenantServiceGroup 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup401Example:
                  summary: Default deleteTenantServiceGroup 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup403Example:
                  summary: Default deleteTenantServiceGroup 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '404':
          description: Tenant Service Group not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup404Example:
                  summary: Default deleteTenantServiceGroup 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteTenantServiceGroup500Example:
                  summary: Default deleteTenantServiceGroup 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /tenant-service-groups/{tsg_id}/children:
    get:
      operationId: listChildTenantServiceGroups
      summary: Palo Alto Networks List Child Tenant Service Groups
      description: >-
        Returns all direct child Tenant Service Groups of the specified
        TSG. Use this endpoint to traverse the TSG hierarchy when managing
        multi-level tenant structures.
      tags:
      - Tenant Service Groups
      parameters:
      - name: tsg_id
        in: path
        required: true
        description: Unique identifier of the parent Tenant Service Group.
        schema:
          type: string
        example: '449835'
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of child TSGs to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Child Tenant Service Groups returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of direct children.
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/TenantServiceGroup'
              examples:
                ListChildTenantServiceGroups200Example:
                  summary: Default listChildTenantServiceGroups 200 response
                  x-microcks-default: true
                  value:
                    total: 806
                    offset: 520
                    limit: 463
                    items:
                    - id: example-id
                      display_name: Carlos Chen
                      description: Traffic threat traffic detected detected on.
                      parent_id: '413395'
                      support_account_id: '979872'
                      vertical: example-vertical
                      region: eu-west-1
                      status: active
                      child_count: 782
                      created_at: '2024-11-10T07:08:17Z'
                      updated_at: '2026-12-02T12:47:54Z'
                    - id: example-id
                      display_name: Carlos Chen
                      description: Traffic threat traffic detected detected on.
                      parent_id: '413395'
                      support_account_id: '979872'
                      vertical: example-vertical
                      region: eu-west-1
                      status: active
                      child_count: 782
                      created_at: '2024-11-10T07:08:17Z'
                      updated_at: '2026-12-02T12:47:54Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListChildTenantServiceGroups401Example:
                  summary: Default listChildTenantServiceGroups 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListChildTenantServiceGroups403Example:
                  summary: Default listChildTenantServiceGroups 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '404':
          description: Parent Tenant Service Group not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListChildTenantServiceGroups404Example:
                  summary: Default listChildTenantServiceGroups 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListChildTenantServiceGroups500Example:
                  summary: Default listChildTenantServiceGroups 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Rule threat threat blocked investigation rule Security malware rule alert activity monitoring.
                    request_id: a63cc0a8-4c7e-4a1b-afd6-5f5a9f73f185
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        OAuth 2.0 Bearer token for SASE platform authentication. Obtain
        using the client_credentials grant with your SASE service account
        client ID and client secret.
  schemas:
    TenantServiceGroup:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the Tenant Service Group.
          example: example-id
        display_name:
          type: string
          description: Human-readable display name of the TSG.
          example: Carlos Chen
        description:
          type: string
          description: Optional description of the TSG's purpose.
          example: Traffic threat traffic detected detected on.
        parent_id:
          type: string
          description: ID of the parent TSG in the hierarchy. Null for root-level TSGs.
          example: '413395'
        support_account_id:
          type: string
          description: Associated Palo Alto Networks support account identifier.
          example: '979872'
        vertical:
          type: string
          description: Industry vertical classification for the TSG.
          example: example-vertical
        region:
          type: string
          description: Primary geographic region for the TSG.
          example: eu-west-1
        status:
          type: string
          enum:
          - active
          - suspended
          - pending
          description: Current status of the TSG.
          example: active
        child_count:
          type: integer
          description: 

# --- truncated at 32 KB (34 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-sase-tenancy-api-openapi-original.yml