openapi: 3.1.0
info:
  title: Palo Alto Networks Autonomous DEM API
  description: >-
    REST API for the Autonomous Digital Experience Management (ADEM)
    platform providing programmatic access to application experience
    scores, agent endpoint scores, synthetic test results, application
    monitoring inventory, and network performance metrics. Autonomous
    DEM continuously monitors the end-to-end digital experience of users
    connecting through Prisma Access, identifying performance degradations
    across the endpoint, local network, ISP, and application layers
    before users report issues. Supports OAuth 2.0 Bearer token
    authentication using the SASE auth framework.
  version: '2.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.sase.paloaltonetworks.com/adem/telemetry/v2
  description: Autonomous DEM telemetry API server.
security:
- oauth2: []
tags:
- name: Agents
  description: Monitored agent and endpoint inventory management.
- name: AgentScores
  description: >-
    Agent and endpoint experience score monitoring for tracking
    the health and experience of monitored user devices.
- name: Applications
  description: Monitored application inventory management.
- name: ApplicationScores
  description: >-
    Application experience score monitoring providing aggregated
    performance ratings for SaaS and internal applications.
- name: Metrics
  description: >-
    Detailed network performance metrics providing granular visibility
    into each segment of the user-to-application connection.
- name: Tests
  description: >-
    Synthetic test results for proactive monitoring of application
    reachability and performance from user endpoints.
paths:
  /mt/monitor/adem/v1/applications/scores:
    get:
      operationId: getApplicationScores
      summary: Palo Alto Networks Get Application Experience Scores
      description: >-
        Returns application experience scores representing the
        end-to-end quality of user interactions with monitored
        applications. Scores range from 0 to 100 with higher values
        indicating better experience. Results can be filtered by
        application, user, site, and time range.
      tags:
      - ApplicationScores
      parameters:
      - name: start_time
        in: query
        description: Start of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2024-04-20T16:09:54Z'
      - name: end_time
        in: query
        description: End of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2025-04-09T17:12:13Z'
      - name: time_range
        in: query
        description: Relative time range shorthand (e.g., last_1_hour, last_24_hours).
        schema:
          type: string
          enum:
          - last_1_hour
          - last_4_hours
          - last_24_hours
          - last_7_days
          - last_30_days
        example: last_30_days
      - name: app_id
        in: query
        description: Filter by monitored application identifier.
        schema:
          type: string
        example: '241281'
      - name: user_id
        in: query
        description: Filter by user email address or identifier.
        schema:
          type: string
        example: '599085'
      - name: site_name
        in: query
        description: Filter by site name.
        schema:
          type: string
        example: Production Policy 68
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
          maximum: 1000
        example: 100
      responses:
        '200':
          description: Application scores returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApplicationScore'
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
              examples:
                GetApplicationScores200Example:
                  summary: Default getApplicationScores 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - timestamp: '2026-08-24T01:11:50Z'
                      app_id: '983491'
                      application: web-browsing
                      user_id: '171053'
                      site_name: Corporate Firewall 32
                      overall_score: 64
                      endpoint_score: 37
                      network_score: 4
                      application_score: 99
                      latency_ms: 16.24
                      packet_loss_pct: 96.61
                      jitter_ms: 59.22
                      sample_count: 162
                    total: 761
                    offset: 140
                    limit: 970
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /mt/monitor/adem/v1/agents/scores:
    get:
      operationId: getAgentScores
      summary: Palo Alto Networks Get Agent and Endpoint Scores
      description: >-
        Returns experience scores for monitored agents and their host
        endpoints. Each agent score reflects the overall digital
        experience quality from that user's device including endpoint
        health, network conditions, and application responsiveness.
      tags:
      - AgentScores
      parameters:
      - name: start_time
        in: query
        description: Start of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2025-01-28T23:44:20Z'
      - name: end_time
        in: query
        description: End of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2026-07-14T21:36:35Z'
      - name: time_range
        in: query
        description: Relative time range shorthand.
        schema:
          type: string
          enum:
          - last_1_hour
          - last_4_hours
          - last_24_hours
          - last_7_days
          - last_30_days
        example: last_24_hours
      - name: user_id
        in: query
        description: Filter by user email address or identifier.
        schema:
          type: string
        example: '519732'
      - name: site_name
        in: query
        description: Filter by site name.
        schema:
          type: string
        example: Production Gateway 79
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
          maximum: 1000
        example: 100
      responses:
        '200':
          description: Agent scores returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/AgentScore'
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
              examples:
                GetAgentScores200Example:
                  summary: Default getAgentScores 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - timestamp: '2024-03-05T03:27:52Z'
                      agent_id: '771821'
                      user_id: '954963'
                      device_name: Primary Agent 31
                      site_name: Staging Policy 66
                      overall_score: 61
                      endpoint_score: 31
                      network_score: 15
                      cpu_usage_pct: 66.06
                      memory_usage_pct: 24.27
                      sample_count: 361
                    total: 624
                    offset: 1
                    limit: 373
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /mt/monitor/adem/v1/tests/{test_id}/results:
    get:
      operationId: getTestResults
      summary: Palo Alto Networks Get Synthetic Test Results
      description: >-
        Returns results for a specific synthetic test. Synthetic tests
        periodically probe application endpoints from ADEM agents to
        measure availability, latency, DNS resolution time, TCP
        connection time, and HTTP response time.
      tags:
      - Tests
      parameters:
      - name: test_id
        in: path
        required: true
        description: Unique synthetic test identifier.
        schema:
          type: string
        example: '251820'
      - name: start_time
        in: query
        description: Start of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2026-07-21T13:05:19Z'
      - name: end_time
        in: query
        description: End of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2026-01-05T17:18:17Z'
      - name: time_range
        in: query
        description: Relative time range shorthand.
        schema:
          type: string
          enum:
          - last_1_hour
          - last_4_hours
          - last_24_hours
          - last_7_days
        example: last_4_hours
      - name: user_id
        in: query
        description: Filter results by specific user.
        schema:
          type: string
        example: '307503'
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      responses:
        '200':
          description: Test results returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  test_id:
                    type: string
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/TestResult'
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
              examples:
                GetTestResults200Example:
                  summary: Default getTestResults 200 response
                  x-microcks-default: true
                  value:
                    test_id: '558183'
                    data:
                    - timestamp: '2024-09-18T20:37:05Z'
                      test_id: '283347'
                      agent_id: '367432'
                      user_id: '579891'
                      status: failure
                      latency_ms: 26.94
                      dns_time_ms: 34.6
                      tcp_connect_ms: 22.64
                      ttfb_ms: 99.24
                      http_status_code: 51
                      error_message: example-error_message
                    total: 499
                    offset: 381
                    limit: 574
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /mt/monitor/adem/v1/applications:
    get:
      operationId: listMonitoredApplications
      summary: Palo Alto Networks List Monitored Applications
      description: >-
        Returns a list of all applications configured for monitoring
        in Autonomous DEM. Each entry includes the application name,
        category, and the synthetic tests configured for probing it.
      tags:
      - Applications
      parameters:
      - name: app_id
        in: query
        description: Filter by specific application identifier.
        schema:
          type: string
        example: '473439'
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      responses:
        '200':
          description: Monitored applications returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/MonitoredApplication'
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListMonitoredApplications200Example:
                  summary: Default listMonitoredApplications 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - app_id: '100488'
                      name: Production Firewall 97
                      category: custom
                      type: saas
                      url: https://vpn.acme-systems.org/a5d006
                      test_count: 241
                      monitored_users: 122
                      created_at: '2026-02-02T08:43:53Z'
                    - app_id: '100488'
                      name: Production Firewall 97
                      category: custom
                      type: saas
                      url: https://vpn.acme-systems.org/a5d006
                      test_count: 241
                      monitored_users: 122
                      created_at: '2026-02-02T08:43:53Z'
                    total: 926
                    offset: 718
                    limit: 679
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /mt/monitor/adem/v1/agents:
    get:
      operationId: listMonitoredAgents
      summary: Palo Alto Networks List Monitored Agents
      description: >-
        Returns a list of all ADEM agents deployed on user endpoints
        that are registered for monitoring. Each entry includes the
        agent version, endpoint device details, user association, and
        current connection status.
      tags:
      - Agents
      parameters:
      - name: user_id
        in: query
        description: Filter agents by user email or identifier.
        schema:
          type: string
        example: '331600'
      - name: site_name
        in: query
        description: Filter agents by site name.
        schema:
          type: string
        example: Production Firewall 26
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
          maximum: 1000
        example: 100
      responses:
        '200':
          description: Monitored agents returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/MonitoredAgent'
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
              examples:
                ListMonitoredAgents200Example:
                  summary: Default listMonitoredAgents 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - agent_id: '421837'
                      user_id: '318842'
                      device_name: Primary Policy 11
                      os: linux
                      os_version: 7.8.5
                      agent_version: 1.2.6
                      site_name: Staging Sensor 98
                      status: degraded
                      last_seen: '2026-05-19T18:55:52Z'
                    total: 809
                    offset: 561
                    limit: 299
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /mt/monitor/adem/v1/metrics:
    get:
      operationId: getPerformanceMetrics
      summary: Palo Alto Networks Get Performance Metrics
      description: >-
        Returns network and application performance metrics collected
        from ADEM agents. Metrics include latency, packet loss, jitter,
        and throughput measurements across each segment of the user-to-
        application path. Supports filtering by user, site, application,
        and time range.
      tags:
      - Metrics
      parameters:
      - name: start_time
        in: query
        description: Start of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2024-05-20T23:09:05Z'
      - name: end_time
        in: query
        description: End of the time range in ISO 8601 format.
        schema:
          type: string
          format: date-time
        example: '2025-01-05T09:42:10Z'
      - name: time_range
        in: query
        description: Relative time range shorthand.
        schema:
          type: string
          enum:
          - last_1_hour
          - last_4_hours
          - last_24_hours
          - last_7_days
        example: last_1_hour
      - name: user_id
        in: query
        description: Filter metrics by user email or identifier.
        schema:
          type: string
        example: '818980'
      - name: site_name
        in: query
        description: Filter metrics by site name.
        schema:
          type: string
        example: Primary Sensor 63
      - name: app_id
        in: query
        description: Filter metrics by application identifier.
        schema:
          type: string
        example: '758710'
      - name: metric_type
        in: query
        description: Type of metrics to retrieve.
        schema:
          type: string
          enum:
          - latency
          - packet_loss
          - jitter
          - throughput
          - dns_resolution
          - tcp_connection
        example: dns_resolution
      - name: granularity
        in: query
        description: Time granularity for metric aggregation.
        schema:
          type: string
          enum:
          - 5m
          - 15m
          - 1h
          - 1d
          default: 15m
        example: 15m
      - name: offset
        in: query
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        schema:
          type: integer
          default: 100
        example: 100
      responses:
        '200':
          description: Performance metrics returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/PerformanceMetric'
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
              examples:
                GetPerformanceMetrics200Example:
                  summary: Default getPerformanceMetrics 200 response
                  x-microcks-default: true
                  value:
                    data:
                    - timestamp: '2025-08-28T13:36:42Z'
                      user_id: '277980'
                      site_name: Branch Sensor 48
                      app_id: '367972'
                      metric_type: jitter
                      value: 1.53
                      unit: example-unit
                      segment: application
                      sample_count: 24
                    - timestamp: '2025-08-28T13:36:42Z'
                      user_id: '277980'
                      site_name: Branch Sensor 48
                      app_id: '367972'
                      metric_type: jitter
                      value: 1.53
                      unit: example-unit
                      segment: application
                      sample_count: 24
                    total: 285
                    offset: 851
                    limit: 405
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  securitySchemes:
    oauth2:
      type: oauth2
      description: >-
        OAuth 2.0 client credentials flow for obtaining an access token.
        Requires a client ID and client secret from the Palo Alto Networks
        SASE identity provider.
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
  responses:
    Unauthorized:
      description: Missing or invalid OAuth2 access token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Invalid request parameters or body.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: The requested resource was not found.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ApplicationScore:
      type: object
      properties:
        timestamp:
          type: string
          format: date-time
          description: Time bucket for the aggregated score.
          example: '2026-08-24T01:11:50Z'
        app_id:
          type: string
          description: Monitored application identifier.
          example: '983491'
        application:
          type: string
          description: Name of the monitored application.
          example: web-browsing
        user_id:
          type: string
          description: User identifier if filtering by user.
          example: '171053'
        site_name:
          type: string
          description: Site name if filtering by site.
          example: Corporate Firewall 32
        overall_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Overall experience score from 0 to 100.
          example: 64
        endpoint_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Endpoint health score.
          example: 37
        network_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Network path score.
          example: 4
        application_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Application responsiveness score.
          example: 99
        latency_ms:
          type: number
          description: Average round-trip latency in milliseconds.
          example: 16.24
        packet_loss_pct:
          type: number
          description: Packet loss percentage.
          example: 96.61
        jitter_ms:
          type: number
          description: Latency variation in milliseconds.
          example: 59.22
        sample_count:
          type: integer
          description: Number of measurement samples in this time bucket.
          example: 162
    AgentScore:
      type: object
      properties:
        timestamp:
          type: string
          format: date-time
          description: Time bucket for the aggregated score.
          example: '2024-03-05T03:27:52Z'
        agent_id:
          type: string
          description: Unique ADEM agent identifier.
          example: '771821'
        user_id:
          type: string
          description: User identifier associated with the agent.
          example: '954963'
        device_name:
          type: string
          description: Hostname of the endpoint device.
          example: Primary Agent 31
        site_name:
          type: string
          description: Site name where the agent is located.
          example: Staging Policy 66
        overall_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Overall experience score for this agent.
          example: 61
        endpoint_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Endpoint hardware and software health score.
          example: 31
        network_score:
          type: integer
          minimum: 0
          maximum: 100
          description: Network connectivity quality score.
          example: 15
        cpu_usage_pct:
          type: number
          description: CPU usage percentage on the endpoint.
          example: 66.06
        memory_usage_pct:
          type: number
          description: Memory usage percentage on the endpoint.
          example: 24.27
        sample_count:
          type: integer
          description: Number of measurement samples in this time bucket.
          example: 361
    TestResult:
      type: object
      properties:
        timestamp:
          type: string
          format: date-time
          description: Timestamp of the test execution.
          example: '2024-09-18T20:37:05Z'
        test_id:
          type: string
          description: Synthetic test identifier.
          example: '283347'
        agent_id:
          type: string
          description: Agent that ran the test.
          example: '367432'
        user_id:
          type: string
          description: User associated with the agent.
          example: '579891'
        status:
          type: string
          enum:
          - success
          - failure
          - timeout
          description: Test execution result status.
          example: failure
        latency_ms:
          type: number
          description: Total response latency in milliseconds.
          example: 26.94
        dns_time_ms:
          type: number
          description: DNS resolution time in milliseconds.
          example: 34.6
        tcp_connect_ms:
          type: number
          description: TCP connection establishment time in milliseconds.
          example: 22.64
        ttfb_ms:
          type: number
          description: Time to first byte for HTTP tests in milliseconds.
          example: 99.24
        http_status_code:
          type: integer
          description: HTTP response status code for HTTP type tests.
          example: 51
        error_message:
          type: string
          description: Error message if the test failed.
          example: example-error_message
    MonitoredApplication:
      type: object
      properties:
        app_id:
          type: string
          description: Unique application identifier.
          example: '100488'
        name:
          type: string
          description: Application name.
          example: Production Firewall 97
        category:
          type: string
          description: Application category (e.g., Collaboration, Productivity, Security).
          example: custom
        type:
          type: string
          enum:
          - saas
          - internal
          description: Whether the application is a SaaS or internal application.
          example: saas
        url:
          type: string
          description: Primary URL for the application.
          example: https://vpn.acme-systems.org/a5d006
        test_count:
          type: integer
          description: Number of synthetic tests configured for this application.
          example: 241
        monitored_users:
          type: integer
          description: Number of users with active monitoring for this application.
          example: 122
        created_at:
          type: string
          format: date-time
          description: Timestamp when the application was added to monitoring.
          example: '2026-02-02T08:43:53Z'
    MonitoredAgent:
      type: object
      properties:
        agent_id:
          type: string
          description: Unique ADEM agent identifier.
          example: '421837'
        user_id:
          type: string
          description: User email or identifier associated with this agent.
          example: '318842'
        device_name:
          type: string
          description: Hostname of the endpoint device.
          example: Primary Policy 11
        os:
          type: string
          enum:
          - windows
          - macos
          - linux
          - ios
          - android
          description: Operating system of the endpoint.
          example: linux
        os_version:
          type: string
          description: Operating system version string.
          example: 7.8.5
        agent_version:
          type: string
          description: ADEM agent software version.
          example: 1.2.6
        site_name:
          type: string
          description: Site name where the agent is located.
          example: Staging Sensor 98
        status:
          type: string
          enum:
          - connected
          - disconnected
          - degraded
          description: Current agent connectivity status.
          example: degraded
        last_seen:
          type: string
          format: date-time
          description: Timestamp of the last agent heartbeat.
          example: '2026-05-19T18:55:52Z'
    PerformanceMetric:
      type: object
      properties:
        timestamp:
          type: string
          format: date-time
          description: Time bucket for the aggregated metric.
          example: '2025-08-28T13:36:42Z'
        user_id:
          type: string
          description: User identifier.
          example: '277980'
        site_name:
          type: string
          description: Site name.
          example: Branch Sensor 48
        app_id:
          type: string
          description: Application identifier if metric is application-specific.
          example: '367972'
        metric_type:
          type: string
          enum:
          - latency
          - packet_loss
          - jitter
          - throughput
          - dns_resolution
          - tcp_connection
          description: Type of performance metric.
          example: jitter
        value:
          type: number
          description: Metric value in the appropriate unit for the metric type.
          example: 1.53
        unit:
          type: string
          description: Unit of measurement (e.g., ms, pct, Mbps).
          example: example-unit
        segment:
          type: string
          enum:
          - endpoint
          - local_network
          - isp
          - prisma_access
          - application
          description: Network segment this metric applies to.
          example: application
        sample_count:
          type: integer
          description: Number of measurement samples in this time bucket.
          example: 24
    ErrorResponse:
      type: object
      properties:
        _errors:
          type: array
          items:
            type: object
            properties:
              code:
                type: string
                example: example-code
              message:
                type: string
                example: Firewall incident blocked blocked firewall configured firewall.
              details:
                type: object
                example: {}
          example:
          - code: example-code
            message: Security detected monitoring activity firewall violation activity.
            details: {}
        _request_id:
          type: string
          example: '921009'