ZTNA Connector API

openapi: 3.1.0
info:
  title: Palo Alto Networks ZTNA Connector API
  description: >-
    ZTNA Connector API for zero trust network access management. Provides
    programmatic control over ZTNA connectors, connector groups, protected
    applications, FQDN-based access rules, subnet-based access rules, and
    license information. Connectors are software agents deployed in private
    network environments that provide secure access paths for ZTNA-protected
    applications without requiring inbound firewall rules. Part of the Palo
    Alto Networks SASE platform.
  version: '2.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.sase.paloaltonetworks.com/ztna
  description: SASE ZTNA Connector API production server.
security:
- oauth2Bearer: []
tags:
- name: Applications
  description: ZTNA-protected application definitions.
- name: Connector Groups
  description: Logical grouping of ZTNA connectors for high availability.
- name: Connectors
  description: ZTNA connector lifecycle management.
- name: FQDN Rules
  description: FQDN-based access rules for ZTNA applications.
- name: Licenses
  description: ZTNA license and entitlement information.
- name: Subnet Rules
  description: Subnet-based access rules for ZTNA network segments.
paths:
  /v2/connectors:
    get:
      operationId: listConnectors
      summary: Palo Alto Networks List ZTNA Connectors
      description: >-
        Returns the list of ZTNA connectors configured for the tenant.
        Connectors are software agents deployed in private network environments.
        Each connector entry includes its current health status, associated
        connector group, software version, and connected application count.
      tags:
      - Connectors
      parameters:
      - name: group_id
        in: query
        description: Filter connectors by connector group ID.
        schema:
          type: string
        example: '716603'
      - name: status
        in: query
        description: Filter connectors by health status.
        schema:
          type: string
          enum:
          - connected
          - disconnected
          - upgrading
          - error
        example: error
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of connectors to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Connectors returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Connector'
              examples:
                ListConnectors200Example:
                  summary: Default listConnectors 200 response
                  x-microcks-default: true
                  value:
                    total: 660
                    offset: 883
                    limit: 838
                    items:
                    - connector_id: '794298'
                      name: Production Gateway 37
                      group_id: '577658'
                      status: connected
                      version: 10.4.9
                      hostname: host-51b1
                      ip_address: 10.28.192.109
                      region: eu-west-1
                      last_seen_at: '2024-07-11T13:58:11Z'
                      created_at: '2025-10-12T04:55:41Z'
                    - connector_id: '794298'
                      name: Production Gateway 37
                      group_id: '577658'
                      status: connected
                      version: 10.4.9
                      hostname: host-51b1
                      ip_address: 10.28.192.109
                      region: eu-west-1
                      last_seen_at: '2024-07-11T13:58:11Z'
                      created_at: '2025-10-12T04:55:41Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectors400Example:
                  summary: Default listConnectors 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectors401Example:
                  summary: Default listConnectors 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectors403Example:
                  summary: Default listConnectors 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectors500Example:
                  summary: Default listConnectors 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createConnector
      summary: Palo Alto Networks Create ZTNA Connector
      description: >-
        Creates a new ZTNA connector configuration and generates the
        installation token needed to deploy the connector software in a
        private network environment. The connector must be assigned to an
        existing connector group.
      tags:
      - Connectors
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectorRequest'
            examples:
              CreateConnectorRequestExample:
                summary: Default createConnector request
                x-microcks-default: true
                value:
                  name: Production Sensor 37
                  group_id: '814975'
                  description: Blocked suspicious investigation malware alert rule policy.
      responses:
        '201':
          description: Connector created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Connector'
              examples:
                CreateConnector201Example:
                  summary: Default createConnector 201 response
                  x-microcks-default: true
                  value:
                    connector_id: '794298'
                    name: Production Gateway 37
                    group_id: '577658'
                    status: connected
                    version: 10.4.9
                    hostname: host-51b1
                    ip_address: 10.28.192.109
                    region: eu-west-1
                    last_seen_at: '2024-07-11T13:58:11Z'
                    created_at: '2025-10-12T04:55:41Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateConnector400Example:
                  summary: Default createConnector 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateConnector401Example:
                  summary: Default createConnector 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateConnector403Example:
                  summary: Default createConnector 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                CreateConnector500Example:
                  summary: Default createConnector 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v2/connectors/{connector_id}:
    get:
      operationId: getConnector
      summary: Palo Alto Networks Get ZTNA Connector
      description: Returns full details for a specific ZTNA connector by ID.
      tags:
      - Connectors
      parameters:
      - name: connector_id
        in: path
        required: true
        description: Unique identifier of the connector.
        schema:
          type: string
        example: '975993'
      responses:
        '200':
          description: Connector details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Connector'
              examples:
                GetConnector200Example:
                  summary: Default getConnector 200 response
                  x-microcks-default: true
                  value:
                    connector_id: '794298'
                    name: Production Gateway 37
                    group_id: '577658'
                    status: connected
                    version: 10.4.9
                    hostname: host-51b1
                    ip_address: 10.28.192.109
                    region: eu-west-1
                    last_seen_at: '2024-07-11T13:58:11Z'
                    created_at: '2025-10-12T04:55:41Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetConnector401Example:
                  summary: Default getConnector 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetConnector403Example:
                  summary: Default getConnector 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: Connector not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetConnector404Example:
                  summary: Default getConnector 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetConnector500Example:
                  summary: Default getConnector 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    put:
      operationId: updateConnector
      summary: Palo Alto Networks Update ZTNA Connector
      description: Updates the configuration of an existing ZTNA connector.
      tags:
      - Connectors
      parameters:
      - name: connector_id
        in: path
        required: true
        description: Unique identifier of the connector to update.
        schema:
          type: string
        example: '321702'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectorRequest'
            examples:
              UpdateConnectorRequestExample:
                summary: Default updateConnector request
                x-microcks-default: true
                value:
                  name: Production Sensor 37
                  group_id: '814975'
                  description: Blocked suspicious investigation malware alert rule policy.
      responses:
        '200':
          description: Connector updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Connector'
              examples:
                UpdateConnector200Example:
                  summary: Default updateConnector 200 response
                  x-microcks-default: true
                  value:
                    connector_id: '794298'
                    name: Production Gateway 37
                    group_id: '577658'
                    status: connected
                    version: 10.4.9
                    hostname: host-51b1
                    ip_address: 10.28.192.109
                    region: eu-west-1
                    last_seen_at: '2024-07-11T13:58:11Z'
                    created_at: '2025-10-12T04:55:41Z'
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector400Example:
                  summary: Default updateConnector 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector401Example:
                  summary: Default updateConnector 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector403Example:
                  summary: Default updateConnector 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: Connector not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector404Example:
                  summary: Default updateConnector 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdateConnector500Example:
                  summary: Default updateConnector 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      operationId: deleteConnector
      summary: Palo Alto Networks Delete ZTNA Connector
      description: >-
        Deletes a ZTNA connector. The connector must be in a disconnected
        state before deletion. Any applications relying on this connector
        must be reassigned first.
      tags:
      - Connectors
      parameters:
      - name: connector_id
        in: path
        required: true
        description: Unique identifier of the connector to delete.
        schema:
          type: string
        example: '352549'
      responses:
        '204':
          description: Connector deleted successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteConnector401Example:
                  summary: Default deleteConnector 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteConnector403Example:
                  summary: Default deleteConnector 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: Connector not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteConnector404Example:
                  summary: Default deleteConnector 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                DeleteConnector500Example:
                  summary: Default deleteConnector 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v2/connectors/{connector_id}/upgrade:
    post:
      operationId: scheduleConnectorUpgrade
      summary: Palo Alto Networks Schedule Connector Upgrade
      description: >-
        Schedules a software upgrade for a specific ZTNA connector. The
        upgrade can be scheduled for immediate execution or for a specified
        maintenance window. During the upgrade, the connector briefly
        disconnects; traffic is routed through other connectors in the
        same group if available.
      tags:
      - Connectors
      parameters:
      - name: connector_id
        in: path
        required: true
        description: Unique identifier of the connector to upgrade.
        schema:
          type: string
        example: '287403'
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                scheduled_at:
                  type: string
                  format: date-time
                  description: >-
                    Scheduled time for the upgrade. If omitted, the upgrade
                    starts immediately.
                target_version:
                  type: string
                  description: >-
                    Target software version. If omitted, upgrades to the
                    latest available version.
            examples:
              ScheduleConnectorUpgradeRequestExample:
                summary: Default scheduleConnectorUpgrade request
                x-microcks-default: true
                value:
                  scheduled_at: '2026-05-12T04:07:50Z'
                  target_version: 10.6.9
      responses:
        '200':
          description: Upgrade scheduled successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  connector_id:
                    type: string
                  upgrade_status:
                    type: string
                    enum:
                    - scheduled
                    - in_progress
                  scheduled_at:
                    type: string
                    format: date-time
                  target_version:
                    type: string
              examples:
                ScheduleConnectorUpgrade200Example:
                  summary: Default scheduleConnectorUpgrade 200 response
                  x-microcks-default: true
                  value:
                    connector_id: '427273'
                    upgrade_status: scheduled
                    scheduled_at: '2024-10-25T18:45:30Z'
                    target_version: 3.9.9
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade400Example:
                  summary: Default scheduleConnectorUpgrade 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade401Example:
                  summary: Default scheduleConnectorUpgrade 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade403Example:
                  summary: Default scheduleConnectorUpgrade 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '404':
          description: Connector not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade404Example:
                  summary: Default scheduleConnectorUpgrade 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ScheduleConnectorUpgrade500Example:
                  summary: Default scheduleConnectorUpgrade 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v2/connector-groups:
    get:
      operationId: listConnectorGroups
      summary: Palo Alto Networks List Connector Groups
      description: >-
        Returns the list of connector groups. Connector groups logically
        group multiple connectors for high availability and load balancing.
        Applications are assigned to connector groups rather than individual
        connectors.
      tags:
      - Connector Groups
      responses:
        '200':
          description: Connector groups returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/ConnectorGroup'
              examples:
                ListConnectorGroups200Example:
                  summary: Default listConnectorGroups 200 response
                  x-microcks-default: true
                  value:
                    total: 673
                    items:
                    - group_id: '985333'
                      name: Staging Sensor 26
                      description: Monitoring investigation blocked applied activity traffic.
                      connector_count: 400
                      region: us-west-2
                      created_at: '2026-09-14T06:06:49Z'
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectorGroups401Example:
                  summary: Default listConnectorGroups 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectorGroups403Example:
                  summary: Default listConnectorGroups 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListConnectorGroups500Example:
                  summary: Default listConnectorGroups 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Security firewall network configured traffic blocked threat.
                    request_id: 709c60bb-8234-4bc4-938b-d0835224c350
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: createConnectorGroup
      summary: Palo Alto Networks Create Connector Group
      description: Creates a new connector group for organizing ZTNA connectors.
      tags:
      - Connector Groups
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ConnectorGroupRequest'
            examples:
              CreateConnectorGroupRequestExample:
                summary: Default createConnectorGroup request
                x-microcks-default: true
                value:
                  name: Corporate Sensor 60
                  description: Violation rule blocked violation network applied incident monitoring.
                  region: us-east-1
      responses:
        '201':
          description: Connector group created success

# --- truncated at 32 KB (93 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-ztna-connector-api-openapi-original.yml