openapi: 3.2.0
info:
  title: Cisco Secure Firewall Access Groups API
  version: 1.13.0
  contact:
    name: Cisco Security Cloud Control TAC
    email: cdo.tac@cisco.com
  description: 'Operations tagged Access Groups across 2 of this provider''s published API definitions: cisco-secure-firewall-scc-firewall-manager-openapi.yml,
    scc-firewall-manager-openapi.yaml. Each path carries the servers of the definition it was published in.'
  x-provenance:
    method: harvested
    first_party: true
    harvested: '2026-08-19'
    source: https://raw.githubusercontent.com/CiscoDevNet/scc-public-api-docs/main/cdo/openapi.yaml
    source_repo: https://github.com/CiscoDevNet/scc-public-api-docs
    note: Verbatim first-party OpenAPI published by Cisco in the CiscoDevNet scc-public-api-docs repository, the source of
      record for developer.cisco.com/docs/cisco-security-cloud-control-firewall-manager/. Not authored or modified by API
      Evangelist.
    derived_view: Per-tag view of cisco-secure-firewall-scc-firewall-manager-openapi.yml, the provider's source document.
      Operations and schemas are the provider's, unmodified; only the partition is ours.
    derived_from: cisco-secure-firewall-scc-firewall-manager-openapi.yml
    operation_coverage: 5/5
  x-evidence:
    fetched: '2026-08-19'
    url: https://raw.githubusercontent.com/CiscoDevNet/scc-public-api-docs/main/cdo/openapi.yaml
    http_status: 200
servers:
- url: https://api.us.security.cisco.com/firewall
  description: US
- url: https://api.eu.security.cisco.com/firewall
  description: EU
- url: https://api.apj.security.cisco.com/firewall
  description: APJ
- url: https://api.au.security.cisco.com/firewall
  description: AUS
- url: https://api.in.security.cisco.com/firewall
  description: IN
- url: https://api.int.security.cisco.com/firewall
  description: Staging
- url: https://scale.manage.security.cisco.com/api/rest
  description: Scale
- url: https://ci.manage.security.cisco.com/api/rest
  description: CI
- url: https://manage.stg.secure.cisco/api/rest
  description: Stgf9
tags:
- name: Access Groups
paths:
  /v1/policies/asa/accessgroups:
    get:
      description: Get a list of ASA Access Groups.
      operationId: listAccessGroups
      parameters:
      - description: The number of results to retrieve.
        in: query
        name: limit
        required: false
        schema:
          maximum: 200
          minimum: 0
          type: string
      - description: The offset of the results retrieved. The Security Cloud Control API uses the offset field to determine
          the index of the first result retrieved, and will retrieve `limit` results from the offset specified.
        in: query
        name: offset
        required: false
        schema:
          minimum: 0
          type: string
      - description: The query to execute. Use the Lucene Query Syntax to construct your query.
        example: fieldName:fieldValue
        in: query
        name: q
        required: false
        schema:
          type: string
      - description: The fields to sort results by.
        example: name:DESC
        in: query
        name: sort
        required: false
        schema:
          items:
            type: string
          type: array
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessGroupPage'
          description: List of Access Groups
        '400':
          $ref: '#/components/responses/http400BadRequest'
        '403':
          $ref: '#/components/responses/http403Forbidden'
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommonApiError'
          description: Internal server error.
      security:
      - bearerAuth: []
      summary: Get Access Groups
      tags:
      - Access Groups
    post:
      description: Create an Access Group
      operationId: createAccessGroup
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessGroupCreateInput'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessGroup'
          description: Security Cloud Control Access Group
        '400':
          $ref: '#/components/responses/http400BadRequest'
        '403':
          $ref: '#/components/responses/http403Forbidden'
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommonApiError'
          description: Internal server error.
      security:
      - bearerAuth: []
      summary: Create Access Group
      tags:
      - Access Groups
    servers:
    - url: https://api.us.security.cisco.com/firewall
      description: US
    - url: https://api.eu.security.cisco.com/firewall
      description: EU
    - url: https://api.apj.security.cisco.com/firewall
      description: APJ
    - url: https://api.au.security.cisco.com/firewall
      description: AUS
    - url: https://api.in.security.cisco.com/firewall
      description: IN
    - url: https://api.int.security.cisco.com/firewall
      description: Staging
    - url: https://scale.manage.security.cisco.com/api/rest
      description: Scale
    - url: https://ci.manage.security.cisco.com/api/rest
      description: CI
    - url: https://manage.stg.secure.cisco/api/rest
      description: Stgf9
  /v1/policies/asa/accessgroups/{accessGroupUid}:
    delete:
      description: Delete Access Group by UID in the Security Cloud Control tenant.
      operationId: deleteAccessGroup
      parameters:
      - description: The unique identifier, represented as a UUID, of the Access Group in Security Cloud Control.
        in: path
        name: accessGroupUid
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '204':
          description: No Content
        '400':
          $ref: '#/components/responses/http400BadRequest'
        '403':
          $ref: '#/components/responses/http403Forbidden'
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommonApiError'
          description: Internal server error.
      security:
      - bearerAuth: []
      summary: Delete Access Group
      tags:
      - Access Groups
    get:
      description: Get a single ASA Access Group by UUID.
      operationId: fetchAccessGroup
      parameters:
      - description: The unique identifier, represented as a UUID, of the Access Group in Security Cloud Control.
        in: path
        name: accessGroupUid
        required: true
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessGroup'
          description: Access Group object
        '400':
          $ref: '#/components/responses/http400BadRequest'
        '403':
          $ref: '#/components/responses/http403Forbidden'
        '404':
          $ref: '#/components/responses/http404NotFound'
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommonApiError'
          description: Internal server error.
      security:
      - bearerAuth: []
      summary: Get Access Group
      tags:
      - Access Groups
    patch:
      description: Modify Security Cloud Control Access Group by UID.
      operationId: patchAccessGroup
      parameters:
      - description: The unique identifier, represented as a UUID, of the Security Cloud Control Access Group.
        in: path
        name: accessGroupUid
        required: true
        schema:
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccessGroupUpdateInput'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessGroup'
          description: Security Cloud Control Access Group
        '400':
          $ref: '#/components/responses/http400BadRequest'
        '403':
          $ref: '#/components/responses/http403Forbidden'
        '404':
          $ref: '#/components/responses/http404NotFound'
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommonApiError'
          description: Internal server error.
      security:
      - bearerAuth: []
      summary: Modify ASA Access Group
      tags:
      - Access Groups
    servers:
    - url: https://api.us.security.cisco.com/firewall
      description: US
    - url: https://api.eu.security.cisco.com/firewall
      description: EU
    - url: https://api.apj.security.cisco.com/firewall
      description: APJ
    - url: https://api.au.security.cisco.com/firewall
      description: AUS
    - url: https://api.in.security.cisco.com/firewall
      description: IN
    - url: https://api.int.security.cisco.com/firewall
      description: Staging
    - url: https://scale.manage.security.cisco.com/api/rest
      description: Scale
    - url: https://ci.manage.security.cisco.com/api/rest
      description: CI
    - url: https://manage.stg.secure.cisco/api/rest
      description: Stgf9
components:
  responses:
    http403Forbidden:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CommonApiError'
      description: User does not have sufficient privileges to perform this operation.
    http404NotFound:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CommonApiError'
      description: Entity not found.
    http400BadRequest:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CommonApiError'
      description: Invalid input provided. Check the response for details.
  schemas:
    AccessGroupCreateInput:
      properties:
        appliedTo:
          description: The set of device unique identifiers to which this Access Group was applied. Only valid for shared
            access group.
          example: '[deviceUid1, deviceUid2, ..., deviceUidN]'
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
        entityUid:
          description: 'The unique identifier, represented as a UUID, of the device/manager associated with the Access Group.
            When creating shared Access Group, entityUid represents device that contains source Access Group '
          example: 7131daad-e813-4b8f-8f42-be1e241e8cdb
          format: uuid
          type: string
        isShared:
          description: The flag that identifies if access group is shared.  If set to true, appliedTo field should be provided
            as well and entityUid should point to source device.
          example: false
          type: boolean
        name:
          description: A human-readable name for the Access Group.
          example: Access-Group1
          type: string
        resources:
          description: The set of of interface and direction pairs or global resource.  Resource is an attribute applicable
            only to devices and will not be propagated to appliedTo devices if Access Group is shared.
          example: 'Interface resource: [{"interfaceName": "outside","direction": "OUTBOUND"] or Global resource: [{"global":
            true}]'
          items:
            additionalProperties: {}
            type: object
          type: array
          uniqueItems: true
      required:
      - entityUid
      type: object
    AccessGroup:
      properties:
        appliedTo:
          description: The set of device unique identifiers to which this Access Group was applied. Only valid for shared
            access group.
          example: '[deviceUid1, deviceUid2, ..., deviceUidN]'
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
        createdDate:
          description: The time (in UTC) at which Access Group was created, represented using the RFC-3339 standard.
          example: 2023-12-13 05:15:44+00:00
          format: date-time
          type: string
        entityUid:
          description: The unique identifier, represented as a UUID, of the device/manager associated with the Access Group.
          example: 7131daad-e813-4b8f-8f42-be1e241e8cdb
          format: uuid
          type: string
        isShared:
          description: The flag that identifies if access group is shared.
          example: false
          type: boolean
        name:
          description: The name of Access Group. Access Group names are unique in Security Cloud Control.
          example: my-example-access-group
          type: string
        resources:
          description: The set of of interface and direction pairs or global resource.
          example: 'Interface resource: [{"interfaceName": "outside"},{"direction": "OUTBOUND"}] or Global resource: [{"global":
            true}]'
          items:
            additionalProperties: {}
            type: object
          type: array
          uniqueItems: true
        sharedAccessGroupUid:
          description: The unique identifier, represented as a UUID, of the shared access group manager associated with the
            Access Group.
          example: 7131daad-e813-4b8f-8f42-be1e241e8cdb
          format: uuid
          type: string
        uid:
          description: The unique identifier, represented as a UUID, of Access Group in Security Cloud Control.
          example: 7131daad-e813-4b8f-8f42-be1e241e8cdb
          format: uuid
          type: string
        updatedDate:
          description: The time (in UTC) at which Access Group was updated, represented using the RFC-3339 standard.
          example: 2023-12-13 05:15:44+00:00
          format: date-time
          type: string
      required:
      - entityUid
      - name
      - sharedAccessGroupUid
      - uid
      type: object
    AccessGroupUpdateInput:
      properties:
        appliedTo:
          description: The set of device unique identifiers to which this Access Group was applied. Only valid for shared
            access group.
          example: '[deviceUid1, deviceUid2, ..., deviceUidN]'
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
        isShared:
          description: The flag that identifies if access group is shared.  If set to true, appliedTo field should be provided
            as well and entityUid should point to source device.
          example: false
          type: boolean
        name:
          description: A human-readable name for the Access Group.
          example: Access-Group1
          type: string
        resources:
          description: The set of of interface and direction pairs or global resource.  Resource is an attribute applicable
            only to devices and will not be propagated to appliedTo devices if Access Group is shared.
          example: 'Interface resource: [{"interfaceName": "outside","direction": "OUTBOUND"] or Global resource: [{"global":
            true}]'
          items:
            additionalProperties: {}
            type: object
          type: array
          uniqueItems: true
      type: object
    CommonApiError:
      properties:
        details:
          additionalProperties:
            description: Additional details, if any, on the error
            example: {}
            type: object
          description: Additional details, if any, on the error
          example: {}
          type: object
        errorCode:
          description: A unique code that describes the error.
          enum:
          - INVALID_INPUT
          - UNAUTHORIZED
          - FORBIDDEN
          - NOT_FOUND
          - METHOD_NOT_ALLOWED
          - CONFLICT
          - TOO_MANY_REQUESTS
          - SERVER_ERROR
          - PROXY_ERROR
          - BAD_REQUEST
          - UNPROCESSABLE_ENTITY
          example: INVALID_INPUT
          type: string
        errorMsg:
          description: A human-readable error description in English.
          example: sample error
          type: string
    AccessGroupPage:
      properties:
        count:
          description: The total number of results available.
          example: 100
          format: int32
          type: integer
        items:
          description: The list of items retrieved.
          items:
            $ref: '#/components/schemas/AccessGroup'
          type: array
        limit:
          description: The number of results retrieved.
          example: 50
          format: int32
          type: integer
        offset:
          description: The offset of the results retrieved. The Security Cloud Control API uses the offset field to determine
            the index of the first result retrieved, and will retrieve `limit` results from the offset specified.
          example: 0
          format: int32
          type: integer
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT
      scheme: bearer
      type: http
x-refined-from:
- cisco-secure-firewall-scc-firewall-manager-openapi.yml
- scc-firewall-manager-openapi.yaml