{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/main/json-schema/palo-alto-networks-device-schema.json",
  "title": "Device",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/palo-alto-networks-devices-api-openapi.yml#/components/schemas/Device",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "format": "string",
      "description": "Unique identifier"
    },
    "externalId": {
      "type": "string",
      "format": "string",
      "description": "External identifier"
    },
    "status": {
      "type": "string",
      "description": "Device status",
      "enum": [
        "active",
        "archived",
        "suspended"
      ]
    },
    "firstSeen": {
      "type": "string",
      "format": "date-time",
      "description": "First seen time"
    },
    "lastSeen": {
      "type": "string",
      "format": "date-time",
      "description": "Last seen time"
    },
    "osType": {
      "type": "string",
      "description": "Operating System type",
      "enum": [
        "windows",
        "macOS",
        "linux",
        "ios",
        "android",
        "unknown"
      ]
    },
    "osVersion": {
      "type": "string",
      "description": "OS Version"
    },
    "osDisplayName": {
      "type": "string",
      "description": "OS Display Name"
    },
    "chromeosVersion": {
      "type": "string",
      "description": "ChromeOS version (only for ChromeOS devices)"
    },
    "locationMethod": {
      "$ref": "#/$defs/LocationMethod"
    },
    "arch": {
      "type": "string",
      "description": "Architecture"
    },
    "nativeArch": {
      "type": "string",
      "description": "Native Architecture"
    },
    "hostname": {
      "type": "string",
      "description": "Hostname"
    },
    "model": {
      "type": "string",
      "description": "Device Model"
    },
    "serialNumber": {
      "type": "string",
      "description": "Serial Number"
    },
    "mobileVendor": {
      "type": "string",
      "description": "Mobile device vendor/manufacturer (e.g., Samsung, Apple)"
    },
    "mobileHardware": {
      "type": "string",
      "description": "Mobile device hardware identifier (e.g., iPhone14,2, SM-G998B)"
    },
    "mobileIsRooted": {
      "type": "boolean",
      "description": "Whether the mobile device is rooted/jailbroken"
    },
    "macAddresses": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "MAC Addresses"
    },
    "screenLockStatus": {
      "type": "string",
      "description": "Screen Lock Status",
      "enum": [
        "ScreenLockStatusUnknown",
        "ScreenLockStatusDisabled",
        "ScreenLockStatusEnabled"
      ]
    },
    "diskEncryptionStatus": {
      "type": "string",
      "description": "Disk Encryption Status",
      "enum": [
        "DiskEncryptionStatusUnknown",
        "DiskEncryptionStatusDisabled",
        "DiskEncryptionStatusEnabled"
      ]
    },
    "diskEncryptionDetails": {
      "$ref": "#/$defs/DeviceDiskEncryptionDetails"
    },
    "firewallStatus": {
      "type": "string",
      "description": "Firewall Status",
      "enum": [
        "FireWallStatusUnknown",
        "FireWallStatusDisabled",
        "FireWallStatusEnabled"
      ]
    },
    "firewallDetails": {
      "$ref": "#/$defs/DeviceFirewallDetails"
    },
    "userAgent": {
      "type": "string",
      "description": "User Agent"
    },
    "ip": {
      "type": [
        "string",
        "null"
      ],
      "description": "IP Address"
    },
    "talonExtensionVersion": {
      "type": "string",
      "description": "Talon Extension Version"
    },
    "browserVersion": {
      "type": "string",
      "description": "Browser Version"
    },
    "browserBrand": {
      "$ref": "#/$defs/DeviceBrowserBrand"
    },
    "deviceType": {
      "type": "string",
      "description": "Device Type",
      "enum": [
        "unknown",
        "desktop",
        "laptop",
        "vm",
        "smartphone",
        "tablet",
        "chromebook"
      ]
    },
    "platform": {
      "$ref": "#/$defs/DevicePlatform"
    },
    "deviceEPP": {
      "$ref": "#/$defs/DeviceEPP"
    },
    "devicePassword": {
      "$ref": "#/$defs/DevicePasswordPosture"
    },
    "crowdstrikeZTA": {
      "$ref": "#/$defs/CrowdstrikeZTAPosture"
    },
    "systemIntegrity": {
      "$ref": "#/$defs/SystemIntegrityPosture"
    },
    "isRunningOnRemoteSession": {
      "type": "boolean",
      "description": "Whether the device is running on a remote session (e.g., RDP, VNC)"
    },
    "deviceManagement": {
      "$ref": "#/$defs/DeviceManagement"
    },
    "browserSelfProtectionModule": {
      "$ref": "#/$defs/BrowserSelfProtectionModule"
    },
    "isOSUserAdmin": {
      "type": "boolean",
      "description": "OS user is admin"
    },
    "isBrowserInstalledAsAdmin": {
      "type": "boolean",
      "description": "Browser installed as admin"
    },
    "user": {
      "$ref": "#/$defs/User"
    }
  },
  "required": [
    "id",
    "status",
    "firstSeen",
    "lastSeen",
    "osType",
    "osDisplayName",
    "platform",
    "browserBrand",
    "arch",
    "nativeArch",
    "hostname",
    "model",
    "serialNumber",
    "macAddresses",
    "screenLockStatus",
    "diskEncryptionStatus",
    "firewallStatus",
    "isBrowserInstalledAsAdmin",
    "userAgent",
    "talonExtensionVersion",
    "browserVersion",
    "deviceType",
    "osVersion",
    "externalId"
  ],
  "$defs": {
    "BrowserSelfProtectionModule": {
      "type": "object",
      "description": "Browser self-protection module",
      "properties": {
        "windows": {
          "type": "object",
          "description": "Windows driver info",
          "properties": {
            "status": {
              "$ref": "#/$defs/BrowserSelfProtectionWindowsDriverStatus"
            }
          }
        }
      }
    },
    "BrowserSelfProtectionWindowsDriverStatus": {
      "type": "string",
      "description": "Windows driver status",
      "default": "Unknown",
      "enum": [
        "Unknown",
        "Protected",
        "Inactive",
        "UnprotectedArmIncompatible",
        "UnprotectedUserInstall",
        "Unprotected"
      ]
    },
    "CrowdstrikeZTAPosture": {
      "type": "object",
      "required": [
        "score",
        "sensorScore",
        "osScore",
        "CID"
      ],
      "properties": {
        "score": {
          "type": "integer"
        },
        "sensorScore": {
          "type": "integer"
        },
        "osScore": {
          "type": "integer"
        },
        "CID": {
          "type": "string"
        }
      }
    },
    "DeviceBrowserBrand": {
      "type": "string",
      "description": "Browser brand",
      "enum": [
        "Arc",
        "Brave",
        "Chrome",
        "Edge",
        "Opera",
        "Dia",
        "Comet",
        "Prisma Browser",
        "Unknown"
      ]
    },
    "DeviceDiskEncryptionDetails": {
      "type": "object",
      "description": "Disk encryption details for the device",
      "required": [
        "products"
      ],
      "properties": {
        "products": {
          "type": "array",
          "description": "List of disk encryption products detected on the device",
          "items": {
            "$ref": "#/$defs/DiskEncryptionProduct"
          }
        }
      }
    },
    "DeviceEPP": {
      "type": "object",
      "required": [
        "products",
        "enabled"
      ],
      "properties": {
        "products": {
          "type": "array",
          "items": {
            "$ref": "#/$defs/EPP"
          }
        },
        "enabled": {
          "type": "boolean"
        }
      }
    },
    "DeviceFirewallDetails": {
      "type": "object",
      "description": "Firewall details for the device",
      "required": [
        "products"
      ],
      "properties": {
        "products": {
          "type": "array",
          "description": "List of firewall products detected on the device",
          "items": {
            "$ref": "#/$defs/FirewallProduct"
          }
        }
      }
    },
    "DeviceManagement": {
      "type": "object",
      "required": [
        "status",
        "systems"
      ],
      "properties": {
        "status": {
          "type": "string",
          "enum": [
            "managed",
            "unmanaged"
          ]
        },
        "systems": {
          "type": "array",
          "description": "Device Management",
          "items": {
            "$ref": "#/$defs/DeviceManagementSystem"
          }
        }
      }
    },
    "DeviceManagementSystem": {
      "type": "object",
      "properties": {
        "system": {
          "type": "string",
          "enum": [
            "ad",
            "azureAd",
            "intune",
            "jamf"
          ]
        },
        "details": {
          "type": "string"
        }
      }
    },
    "DevicePasswordPosture": {
      "type": "object",
      "required": [
        "enabled",
        "products"
      ],
      "properties": {
        "enabled": {
          "type": "boolean"
        },
        "passwordPolicy": {
          "$ref": "#/$defs/DevicePasswordPosturePolicy"
        }
      }
    },
    "DevicePasswordPosturePolicy": {
      "type": "object",
      "required": [
        "complexityReq",
        "maxPasswordAge",
        "minPasswordLength"
      ],
      "properties": {
        "complexityReq": {
          "type": "boolean"
        },
        "maxPasswordAge": {
          "type": "integer"
        },
        "minPasswordLength": {
          "type": "integer"
        }
      }
    },
    "DevicePlatform": {
      "type": "string",
      "description": "Device platform",
      "enum": [
        "Desktop Browser",
        "Mobile Browser",
        "Browser Extension",
        "Unknown"
      ]
    },
    "DiskEncryptionProduct": {
      "type": "object",
      "description": "Disk encryption product information",
      "required": [
        "vendorName",
        "productName",
        "fullyEncrypted"
      ],
      "properties": {
        "vendorName": {
          "$ref": "#/$defs/DiskEncryptionVendorName"
        },
        "productName": {
          "type": "string",
          "description": "Product name of the disk encryption product"
        }
      }
    },
    "DiskEncryptionVendorName": {
      "type": "string",
      "description": "Disk encryption vendor name",
      "enum": [
        "2BrightSparks Pte Ltd",
        "Acronis",
        "Adolix",
        "Apimac, software",
        "Apple Inc.",
        "archicrypt",
        "Arcserve (USA), LLC",
        "Ashampoo GmbH & Co. KG",
        "AVG Technologies CZ, s.r.o.",
        "Axantum Software AB",
        "AxCrypt AB",
        "Beachhead Solutions",
        "Becrypt Ltd",
        "BeLight Software Ltd.",
        "Bitdefender",
        "Braincell consult & research GmbH",
        "Check Point Software Technologies",
        "CipherShed",
        "COMODO Security Solutions",
        "CoSoSys Ltd.",
        "CP-Lab.com",
        "Crypto Systems, Inc.",
        "Cypherix Software Pvt. Ltd.",
        "DATEV eG",
        "Dekart",
        "Dell Inc.",
        "Deltacrypt Technologies Inc",
        "DESlock Limited",
        "Digital Millenium Inc.",
        "DoGoodSoft",
        "EgoSecure",
        "EGSoftWeb",
        "ENC Security Systems",
        "Encrypt4all Software",
        "ESET",
        "Evgeny Korovin",
        "EXLADE, Inc.",
        "Exosphere Labs, Inc.",
        "FileEncryption.org.",
        "G Data Software AG",
        "GiliSoft International LLC",
        "GitHub, Inc.",
        "GitLab Inc.",
        "Hewlett-Packard",
        "Hitek Software LLC",
        "HummerStudio",
        "IDRIX",
        "InterCrypto Ltd",
        "Inv Softworks LLC",
        "Jetico, Inc.",
        "Kaspersky Lab",
        "Kovell Ventures Ltd.",
        "Kromtech",
        "Kruptos 2 Software",
        "Lavasoft",
        "MadowSoft Software",
        "Max Secure Software",
        "McAfee, Inc.",
        "Microsoft Corporation",
        "MicroWorld Technologies Inc.",
        "Mnemonic Security Inc.",
        "MoRUN.net",
        "MSecure Data Labs",
        "NCH Software",
        "New Softwares.net",
        "Nomadesk NV",
        "ntldr",
        "Packetizer, Inc.",
        "Panda Security, S.L.",
        "PC Dynamics",
        "PDFKey",
        "PRIMX",
        "R-tools Technology, Inc.",
        "Ranquel Technologies",
        "RentAnAdviser",
        "Rogers",
        "Safetica Technologies",
        "Sarah Dean",
        "SecurStar GmbH",
        "SoftWinter",
        "Solid Programs",
        "Sophos Limited",
        "Stoneage Softwares",
        "SUSE LINUX GmbH",
        "Symantec Corporation",
        "TEHTRIS",
        "Tesline-Service SRL",
        "The Gpg4win Project",
        "Trellix",
        "Trend Micro, Inc.",
        "TrueCrypt Foundation",
        "TrustPort, a.s.",
        "Utimaco Safeware AG",
        "Vassil Arabadjiev",
        "WARDWIZ",
        "Webminds, Inc.",
        "WinEncrypt",
        "WinMagic Inc.",
        "Zmanda, Inc."
      ]
    },
    "EPP": {
      "type": "object",
      "required": [
        "name",
        "version",
        "state"
      ],
      "properties": {
        "name": {
          "type": "string"
        },
        "version": {
          "type": "string"
        },
        "state": {
          "type": "string"
        }
      }
    },
    "FirewallProduct": {
      "type": "object",
      "description": "Firewall product information",
      "required": [
        "vendorName",
        "productName",
        "enabled"
      ],
      "properties": {
        "vendorName": {
          "$ref": "#/$defs/FirewallVendorName"
        },
        "productName": {
          "type": "string",
          "description": "Product name of the firewall"
        },
        "enabled": {
          "type": "boolean",
          "description": "Whether the firewall is enabled"
        }
      }
    },
    "FirewallVendorName": {
      "type": "string",
      "description": "Firewall vendor name",
      "enum": [
        "Agnitum Ltd.",
        "NETGATE Technologies s.r.o.",
        "ParetoLogic, Inc.",
        "LANDESK Software, Inc.",
        "AT&T",
        "Bitdefender",
        "Mysecuritywin",
        "G Data Software AG",
        "Max Secure Software",
        "AhnLab, Inc.",
        "AVG Technologies CZ, s.r.o.",
        "Symantec Corporation",
        "Kaspersky Lab",
        "Avira GmbH",
        "Panda Security, S.L.",
        "Webroot Software, Inc.",
        "Quick Heal Technologies (P) Ltd.",
        "nProtect, Inc.",
        "F-Secure Corporation",
        "ThreatTrack Security, Inc.",
        "McAfee, Inc.",
        "eEye Digital Security",
        "Arcabit",
        "BeyondTrust, Inc.",
        "Telefónica S.A.",
        "GEN-X Technologies",
        "K7 Computing Pvt Ltd",
        "Faronics Corporation",
        "TELUS",
        "Kingsoft Corporation",
        "BiniSoft.org",
        "GFI Software Ltd.",
        "TG Soft S.a.s.",
        "Scandium Security Inc.",
        "Datpol",
        "Tech Guard Technologies",
        "NCP engineering GmbH",
        "SoftSphere Technologies",
        "Quick Guard Technologies",
        "Emsisoft Ltd",
        "Datalink Industrial Corporation",
        "COMODO Security Solutions",
        "MicroWorld Technologies Inc.",
        "AVAST Software a.s.",
        "ESET",
        "Beijing Rising Information Technology Co., Ltd.",
        "Smart Heal",
        "Rogers",
        "Check Point Software Technologies",
        "CellSecurity",
        "AS3 Soft4U",
        "Ates Software & Internet Technologies",
        "MSecure Data Labs",
        "SGA SOLUTIONS",
        "ALLIT Service, LLC.",
        "adaware",
        "SentinelOne",
        "CrowdStrike, Inc.",
        "CSIS Security Group",
        "SOURCENEXT CORPORATION",
        "Microsoft Corporation",
        "SecureMix LLC",
        "Swiss security laboratory.",
        "AsiaInfo, Inc.",
        "INCA Internet Co., Ltd.",
        "ESTsoft Corp.",
        "Sunrise Antivirus",
        "Hauri, Inc.",
        "SecuraShield India Pvt. Ltd.",
        "NIFTY Corporation",
        "Trend Micro, Inc.",
        "Fujitsu Services Ltd.",
        "LogMeIn, Inc.",
        "Stormshield",
        "Palo Alto Networks, Inc.",
        "Chili Security",
        "Sophos Limited",
        "NortonLifeLock Inc",
        "Massachusetts Institute of Technology",
        "WatchGuard Technologies Inc",
        "Beijing Huorong Network Technology Co., Ltd.",
        "Le Minh Thanh",
        "Qi An Xin Group",
        "Avast Software s.r.o.",
        "TEHTRIS",
        "Avira Operations GmbH & Co. KG",
        "WithSecure Corporation",
        "Musarubra US LLC.",
        "GoTo, Inc.",
        "INCA Internet Co.,Ltd.",
        "SECURA WEB DATA LABS PVT LTD",
        "Broadcom",
        "Gen Digital Inc.",
        "Actipace Private Limited",
        "Siyano Labs Pvt. Ltd.",
        "Bkav Corporation",
        "CMC InfoSec",
        "Total Defense, Inc.",
        "TrustPort, a.s.",
        "Fortinet Inc.",
        "Avanquest Software",
        "Doctor Web, Ltd.",
        "Security Software Limited",
        "BullGuard Ltd.",
        "HDD Labs. Inc",
        "EarthLink, Inc.",
        "Roboscan Inc",
        "Thirtyseven4",
        "PC Security Shield",
        "CA, Inc.",
        "Privacyware/PWI, Inc.",
        "Károly Pados",
        "PeerBlock, LLC",
        "ProgrammerWorld.Net",
        "Jetico, Inc.",
        "Tiny Software Inc.",
        "Sphinx Software",
        "Defender Pro",
        "Soft4Ever",
        "Lavasoft",
        "Norman AS",
        "PC Tools Software",
        "Apple Inc."
      ]
    },
    "LocationMethod": {
      "type": "string",
      "description": "Location detection method",
      "enum": [
        "GeoIp",
        "Location services",
        "Unknown"
      ]
    },
    "SystemIntegrityPosture": {
      "type": "object",
      "required": [
        "status",
        "services"
      ],
      "properties": {
        "status": {
          "$ref": "#/$defs/SystemIntegrityPostureStatus"
        },
        "services": {
          "$ref": "#/$defs/SystemIntegrityPostureServices"
        }
      }
    },
    "SystemIntegrityPostureServices": {
      "type": "object",
      "properties": {
        "driversSigningEnforcement": {
          "type": "boolean"
        },
        "kernelDebugger": {
          "type": "boolean"
        },
        "secureBoot": {
          "type": "boolean"
        },
        "SIP": {
          "type": "boolean"
        },
        "gatekeeper": {
          "type": "boolean"
        }
      }
    },
    "SystemIntegrityPostureStatus": {
      "type": "string",
      "description": "System integrity status",
      "enum": [
        "pass",
        "fail",
        "unknown"
      ]
    },
    "User": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "format": "string",
          "description": "Unique identifier"
        },
        "externalId": {
          "type": "string",
          "format": "string",
          "description": "External identifier"
        },
        "email": {
          "type": "string",
          "description": "Email"
        },
        "lastSeen": {
          "type": "string",
          "format": "date-time",
          "description": "Last seen time"
        },
        "firstSeen": {
          "type": "string",
          "format": "date-time",
          "description": "First seen time"
        },
        "name": {
          "type": "string",
          "description": "Name"
        },
        "profilePictureURL": {
          "type": "string",
          "description": "Profile Picture URL"
        },
        "deletedTime": {
          "type": "string",
          "format": "date-time",
          "description": "Deleted Time"
        },
        "status": {
          "$ref": "#/$defs/UserStatus"
        },
        "provider": {
          "type": "string",
          "description": "Provider",
          "enum": [
            "saml",
            "local",
            "oidc"
          ]
        },
        "deviceIds": {
          "type": "array",
          "description": "Device IDs",
          "items": {
            "type": "string"
          }
        },
        "userGroups": {
          "type": "array",
          "description": "User Groups",
          "items": {
            "$ref": "#/$defs/UserGroup"
          }
        }
      },
      "required": [
        "id",
        "email",
        "lastSeen",
        "firstSeen",
        "name",
        "profilePictureURL",
        "deletedTime",
        "status",
        "provider",
        "externalId"
      ]
    },
    "UserGroup": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "description": "Unique identifier"
        },
        "name": {
          "type": "string",
          "description": "Name"
        },
        "lastUpdated": {
          "type": "string",
          "format": "date-time",
          "description": "Last updated"
        },
        "createdAt": {
          "type": "string",
          "format": "date-time",
          "description": "Created at"
        },
        "provider": {
          "type": "string",
          "enum": [
            "sso",
            "local"
          ],
          "description": "Provider"
        }
      },
      "required": [
        "id",
        "name"
      ]
    },
    "UserStatus": {
      "type": "string",
      "description": "User status",
      "enum": [
        "active",
        "suspended"
      ]
    }
  }
}