openapi: 3.2.0
info:
  contact:
    email: support@paloaltonetworks.com
  description: 'The Open API specification file represents the APIs available for Prisma Access Insights 3.0.

    The Prisma Access Insights 3.0 APIs allow you to query your Prisma Access tenant for the health of

    your Prisma Access network deployment. The 3.0 APIs are intended for cloud-managed Prisma Access

    customers, where the tenants have been onboarded by Palo Alto Networks using a Tenant Service Group

    (TSG) identifier.


    These APIs use the common SASE authentication mechanism and base URL. See the

    [Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information.


    This Open API spec file was created on May 30, 2025. To check for a more recent version of this file, see

    [Prisma Insights APIs on pan.dev](https://pan.dev//access/api/insights/).


    © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo

    Alto Networks. A list of our trademarks can be found at


    [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html)


    All other marks mentioned herein may be trademarks of their respective companies.

    '
  license:
    name: MIT
    url: https://opensource.org/license/mit
  termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  title: Palo Alto Networks 3.0 Agent Users API API
  version: '3.0'
servers:
- url: https://api.sase.paloaltonetworks.com
tags:
- description: 'Retrieve the agent client version distribution, providing agent details.

    '
  name: Agent Users API
paths:
  /insights/v3.0/resource/export/query/users/agent/user_list:
    post:
      description: 'Export a list of agent users.

        '
      operationId: post-insights-v3.0-resource-export-query-users-agent-user_list
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: device_name
                      values:
                      - device1
                    - operator: in
                      property: agent_version
                      values:
                      - 1.0.0
                    - operator: in
                      property: client_os_version
                      values:
                      - Windows 10
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: client_public_address
                      values:
                      - 1.1.1.1
                    - operator: in
                      property: source_ip
                      values:
                      - 192.168.1.1
                    - operator: in
                      property: usergroups
                      values:
                      - admin
                    - operator: in
                      property: application_name
                      values:
                      - Zoom
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: experience_score_aggregate_value
                      values:
                      - 90
                    - operator: in
                      property: device_score_aggregate_value
                      values:
                      - 80
                    - operator: in
                      property: lan_score_aggregate_value
                      values:
                      - 70
                    - operator: in
                      property: wifi_score_aggregate_value
                      values:
                      - 60
                    - operator: in
                      property: pa_score_aggregate_value
                      values:
                      - 50
                    - operator: in
                      property: internet_score_aggregate_value
                      values:
                      - 40
                    - operator: in
                      property: device_self_serve_status
                      values:
                      - true
                    - operator: in
                      property: device_isp_name
                      values:
                      - Verizon
                    - operator: in
                      property: instance_name
                      values:
                      - FW1
                    - operator: in
                      property: instance_name
                      values:
                      - instance1
                    - operator: in
                      property: project_name
                      values:
                      - project1
                    - operator: in
                      property: location_group_name
                      values:
                      - location_group1
                    - operator: in
                      property: domain_name
                      values:
                      - zoom.us
                    - operator: in
                      property: agent_type
                      values:
                      - Agent
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          agent_type:
                            description: Client agent type.
                            example: Agent
                            type: string
                          agent_version:
                            description: Client agent version.
                            example: 1.0.0
                            type: string
                          application_name:
                            description: Application name.
                            example: Zoom
                            type: string
                          client_os_version:
                            description: Client OS version.
                            example: Windows 10
                            type: string
                          device_isp_name:
                            description: ISP name.
                            example: Verizon
                            type: string
                          device_name:
                            description: Device name source.
                            example: device1
                            type: string
                          device_score_aggregate_value:
                            description: Device score.
                            example: 80
                            type: number
                          device_self_serve_status:
                            description: Self-serve user enabled.
                            example: true
                            type: boolean
                          domain_name:
                            description: Application domain name.
                            example: zoom.us
                            type: string
                          edge_location_display_name:
                            description: Prisma Access location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score_aggregate_value:
                            description: Experience score.
                            example: 90
                            type: number
                          instance_name:
                            description: Instance name.
                            example: instance1
                            type: string
                          internet_score_aggregate_value:
                            description: Internet score.
                            example: 40
                            type: number
                          lan_score_aggregate_value:
                            description: LAN score.
                            example: 70
                            type: number
                          location_group_name:
                            description: Location group name.
                            example: location_group1
                            type: string
                          pa_score_aggregate_value:
                            description: PA score.
                            example: 50
                            type: number
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Project name.
                            example: project1
                            type: string
                          source_city:
                            description: Source city name.
                            example: San Jose
                            type: string
                          source_country:
                            description: Source country name.
                            example: US
                            type: string
                          source_ip:
                            description: Source IP address.
                            example: 192.168.1.1
                            type: string
                          usergroups:
                            description: User groups.
                            example: admin
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                          wifi_score_aggregate_value:
                            description: WiFi score.
                            example: 60
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  accelerated:
                    description: Accelerated.
                    example: true
                    type: boolean
                  adem_username:
                    description: Adem Username.
                    example: john.doe@company.com
                    type: string
                  application_count:
                    description: Application count.
                    example: 5
                    type: integer
                  device_count:
                    description: Device count.
                    example: 2
                    type: integer
                  last_activity_timestamp_epoc_millis:
                    description: Last activity timestamp epoch millis.
                    example: 1678886400000
                    type: integer
                  location_group_name:
                    description: Location group name.
                    example: location_group1
                    type: string
                  project_name:
                    description: Project name.
                    example: project1
                    type: string
                  threat_count:
                    description: Threat count.
                    example: 714
                    type: integer
                  total_bytes:
                    description: Total bytes.
                    example: 179246404
                    type: integer
                  username:
                    description: Username.
                    example: john.doe
                    type: string
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Export Agent User List
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/client_version_distribution:
    post:
      description: 'Retrieve the distribution of agent client versions.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-client_version_distribution
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: client_agent_type
                      values:
                      - traped
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: client_agent_type
                      values:
                      - traped
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: device_name_source
                      values:
                      - DHCP
                    - operator: in
                      property: client_agent_version
                      values:
                      - 7.1.2
                    - operator: in
                      property: client_os_version
                      values:
                      - 10.15.7
                    - operator: in
                      property: source_city_name
                      values:
                      - San Jose
                    - operator: in
                      property: source_country_name
                      values:
                      - US
                    - operator: in
                      property: client_public_address
                      values:
                      - 203.0.113.45
                    - operator: in
                      property: pa_location_name
                      values:
                      - US West
                    - operator: in
                      property: usergroups
                      values:
                      - Employees
                    - operator: in
                      property: self_serve_user_enabled
                      values:
                      - true
                    - operator: in
                      property: isp_name
                      values:
                      - Verizon
                    - operator: in
                      property: fw_name
                      values:
                      - FW-1
                    - operator: in
                      property: project_name
                      values:
                      - Project-A
                    - operator: in
                      property: location_group_name
                      values:
                      - Location-Group-1
                    - operator: in
                      property: app_domain_name
                      values:
                      - google.com
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          app_domain_name:
                            description: Name of the application domain.
                            example: google.com
                            type: string
                          client_agent_type:
                            description: Type of the client agent.
                            example: traped
                            type: string
                          client_agent_version:
                            description: Version of the client agent.
                            example: 7.1.2
                            type: string
                          client_os_version:
                            description: Version of the client OS.
                            example: 10.15.7
                            type: string
                          client_public_address:
                            description: Public IP address of the client.
                            example: 203.0.113.45
                            type: string
                          device_name_source:
                            description: Source of the device name.
                            example: DHCP
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          fw_name:
                            description: Name of the firewall.
                            example: FW-1
                            type: string
                          isp_name:
                            description: Name of the ISP.
                            example: Verizon
                            type: string
                          location_group_name:
                            description: Name of the location group.
                            example: Location-Group-1
                            type: string
                          pa_location_name:
                            description: Name of the Prisma Access location.
                            example: US West
                            type: string
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Name of the project.
                            example: Project-A
                            type: string
                          self_serve_user_enabled:
                            description: Is self serve user enabled.
                            example: true
                            type: boolean
                          source_city_name:
                            description: Name of the source city.
                            example: San Jose
                            type: string
                          source_country_name:
                            description: Name of the source country.
                            example: US
                            type: string
                          usergroups:
                            description: User groups.
                            example: Employees
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      - client_agent_type
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  client_agent_version:
                    description: Version of the client agent.
                    example: 7.1.2
                    type: string
                  num_devices:
                    description: Number of devices using this client agent version.
                    example: 10
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Agent Client Version Distribution
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/connected_entity_count:
    post:
      description: 'Retrieve the number of connected entities based on specified filters.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-connected_entity_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: connect_method
                      values:
                      - AGENT
                      - AGENT_PROXY
                    - operator: in
                      property: application_name
                      values:
                      - zoom
                    - operator: in
                      property: experience_score
                      values:
                      - 90
                    - operator: in
                      property: device_score
                      values:
                      - 90
                    - operator: in
                      property: lan_score
                      values:
                      - 90
                    - operator: in
                      property: wifi_score
                      values:
                      - 90
                    - operator: in
                      property: pa_score
                      values:
                      - 90
                    - operator: in
                      property: internet_score
                      values:
                      - 90
                    - operator: in
                      property: rbi
                      values:
                      - enabled
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: instance_name
                      values:
                      - fw00
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: username
                      values:
                      - john.doe
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Application name.
                            example: zoom
                            type: string
                          connect_method:
                            description: Connection method.
                            example: AGENT
                            type: string
                          device_score:
                            description: Device score.
                            example: 90
                            type: number
                          edge_location_display_name:
                            description: Prisma Access Location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: Experience score.
                            example: 90
                            type: number
                          instance_name:
                            description: Instance name.
                            example: fw00
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 90
                            type: number
                          lan_score:
                            description: LAN score.
                            example: 90
                            type: number
                          pa_score:
                            description: PA score.
                            example: 90
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          rbi:
                            description: RBI status.
                            example: enabled
                            type: string
                          source_city:
                            description: City from GeoIP.
                            example: San Jose
                            type: string
                          source_country:
                            description: Country from GeoIP.
                            example: US
                            type: string
                          username:
                            description: Source user name.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: WiFi score.
                            example: 90
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Count of connected entities.
                    example: 1034
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Connected Entity Data
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/connected_user_count_histogram:
    post:
      description: 'Retrieve a histogram of connected user data without filters.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-connected_user_count_histogram
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                  histogram:
                    enableEmptyInterval: true
                    property: event_time
                    range: minute
                    value: 30
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: device_name
                      values:
                      - Johns-MacBook-Pro
                    - operator: in
                      property: client_agent_version
                      values:
                      - 10.0.0
                    - operator: in
                      property: client_os_version
                      values:
                      - 10.15.7
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: user_source_ip_address
                      values:
                      - 203.0.113.45
                    - operator: in
                      property: usergroups
                      values:
                      - Domain Users
                    - operator: in
                      property: application_name
                      values:
                      - Zoom
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: experience_score
                      values:
                      - 80
                    - operator: in
                      property: device_score
                      values:
                      - 90
                    - operator: in
                      property: lan_score
                      values:
                      - 75
                    - operator: in
                      property: wifi_score
                      values:
                      - 85
                    - operator: in
                      property: pa_score
                      values:
                      - 95
                    - operator: in
                      property: internet_score
                      values:
                      - 70
                    - operator: in
                      property: self_serve_user_enabled
                      values:
                      - true
                    - operator: in
                      property: device_isp_name
                      values:
                      - Verizon
                    - operator: in
                      property: fw_name
                      values:
                      - PA-VM
                    - operator: in
                      property: project_name
                      values:
                      - Project-Alpha
                    - operator: in
                      property: location_group_name
                      values:
                      - HQ-Location
                    - operator: in
                      property: domain_name
                      values:
                      - zoom.us
                  histogram:
                    enableEmptyInterval: true
                    property: event_time
                    range: minute
                    value: 30
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Name of the application.
                            example: Zoom
                            type: string
                          client_agent_version:
                            description: Version of the client agent.
                            example: 10.0.0
                            type: string
                          client_os_version:
                            description: Version of the client OS.
                            example: 10.15.7
                            type: string
                          device_isp_name:
                            description: Name of the ISP.
                            example: Verizon
                            type: string
                          device_name:
                            description: Name of the device.
                            example: Johns-MacBook-Pro
                            type: string
                          device_score:
                            description: Device score.
                            example: 90
                            type: number
                          domain_name:
                            description: Name of the application domain.
                            example: zoom.us
                            type: string
                          edge_location_display_name:
                            description: Prisma Access location name.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: Experience score.
                            example: 80
                            type: number
                          fw_name:
                            description: Name of the firewall.
                            example: PA-VM
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 70
                            type: number
                          lan_score:
                            description: LAN score.
                            example: 75
                            type: number
                          location_group_name:
                            description: Name of the location group.
                            example: HQ-Location
                            type: string
                          pa_score:
                            description: PA score.
                            example: 95
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Name of the project.
                            example: Project-Alpha
                            type: string
                          self_serve_user_enabled:
                            description: Indicates if self-serve user is enabled.
                            example: true
                            type: boolean
                          source_city:
                            description: Name of the source city.
                            example: San Jose
                            type: string
                          source_country:
                            description: Name of the source country.
                            example: US
                            type: string
                          user_source_ip_address:
                            description: Public IP address of the client.
                            example: 203.0.113.45
                            type: string
                          usergroups:
                            description: User groups.
                            example: Domain Users
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: WiFi score.
                            example: 85
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  count_high:
                    description: Number of users with high experience score
                    example: 4406
                    type: integer
                  count_low:
                    description: Number of users with low experience score
                    example: 3412
                    type: integer
                  event_time:
                    description: Event time
                    example: 1709226000000
                    type: number
                  user_count:
                    description: Number of users
                    example: 4761
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Connected User Histogram Data
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/connected_user_device_count_histogram:
    post:
      description: 'Retrieve a histogram of connected user device data without filters.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-connected_user_device_count_histogram
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                  histogram:
                    enableEmptyInterval: true
                    property: event_time
                    range: minute
                    value: 30
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: device_name
                      values:
                      - device1
                    - operator: in
                      property: client_agent_version
                      values:
                      - 1.0.0
                    - operator: in
                      property: client_os_version
                      values:
                      - Windows 10
                    - operator: in
                      property: source_city_name
                      values:
                      - San Jose
                    - operator: in
                      property: source_country_name
                      values:
                      - US
                    - operator: in
                      property: user_source_ip_address
                      values:
                      - 1.1.1.1
                    - operator: in
                      property: usergroups
                      values:
                      - group1
                    - operator: in
                      property: application_name
                      values:
                      - app1
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: experience_score
                      values:
                      - 5
                    - operator: in
                      property: device_score
                      values:
                      - 5
                    - operator: in
                      property: lan_score
                      values:
                      - 5
                    - operator: in
                      property: wifi_score
                      values:
                      - 5
                    - operator: in
                      property: pa_score
                      values:
                      - 5
                    - operator: in
                      property: internet_score
                      values:
                      - 5
                    - operator: in
                      property: self_serve_user_enabled
                      values:
                      - true
                    - operator: in
                      property: isp_name
                      values:
                      - Verizon
                    - operator: in
                      property: fw_name
                      values:
                      - fw1
                    - operator: in
                      property: project_name
                      values:
                      - project1
                    - operator: in
                      property: location_group_name
                      values:
                      - location_group1
                    - operator: in
                      property: domain_name
                      values:
                      - zoom.us
                  histogram:
                    enableEmptyInterval: true
                    property: event_time
                    range: minute
                    value: 30
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Name of the application.
                            example: app1
                            type: string
                          client_agent_version:
                            description: Version of the client agent.
                            example: 1.0.0
                            type: string
                          client_os_version:
                            description: Version of the client OS.
                            example: Windows 10
                            type: string
                          device_name:
                            description: Name of the device.
                            example: device1
                            type: string
                          device_score:
                            description: Device score.
                            example: 5
                            type: number
                          device_self_serve_status:
                            description: Self serve user enabled.
                            example: true
                            type: boolean
                          domain_name:
                            description: Application domain name.
                            example: zoom.us
                            type: string
                          edge_location_display_name:
                            description: Name of the PA location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: Experience score.
                            example: 5
                            type: number
                          fw_name:
                            description: Firewall name.
                            example: fw1
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 5
                            type: number
                          isp_name:
                            description: ISP name.
                            example: Verizon
                            type: string
                          lan_score:
                            description: LAN score.
                            example: 5
                            type: number
                          location_group_name:
                            description: Location group name.
                            example: location_group1
                            type: string
                          pa_score:
                            description: PA score.
                            example: 5
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Project name.
                            example: project1
                            type: string
                          source_city_name:
                            description: Name of the source city.
                            example: San Jose
                            type: string
                          source_country_name:
                            description: Name of the source country.
                            example: US
                            type: string
                          user_source_ip_address:
                            description: Public IP address of the client.
                            example: 1.1.1.1
                            type: string
                          usergroups:
                            description: User groups.
                            example: group1
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: Wifi score.
                            example: 5
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  device_count:
                    description: Number of devices connected
                    example: 10
                    type: number
                  event_time:
                    description: Event time
                    example: 1709226000000
                    type: number
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Connected User Device Histogram Data
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/current_connected_device_count:
    post:
      description: 'Retrieve the current number of connected devices without filters.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-current_connected_device_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: device_name
                      values:
                      - device1
                    - operator: in
                      property: client_agent_version
                      values:
                      - 1.0.0
                    - operator: in
                      property: client_os_version
                      values:
                      - Windows 10
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: client_public_address
                      values:
                      - 1.1.1.1
                    - operator: in
                      property: usergroups
                      values:
                      - group1
                    - operator: in
                      property: application_name
                      values:
                      - app1
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: experience_score
                      values:
                      - 50
                    - operator: in
                      property: device_score
                      values:
                      - 50
                    - operator: in
                      property: lan_score
                      values:
                      - 50
                    - operator: in
                      property: wifi_score
                      values:
                      - 50
                    - operator: in
                      property: pa_score
                      values:
                      - 50
                    - operator: in
                      property: internet_score
                      values:
                      - 5
                    - operator: in
                      property: device_self_serve_status
                      values:
                      - true
                    - operator: in
                      property: device_isp_name
                      values:
                      - Verizon
                    - operator: in
                      property: instance_name
                      values:
                      - fw1
                    - operator: in
                      property: project_name
                      values:
                      - project1
                    - operator: in
                      property: location_group_name
                      values:
                      - location_group1
                    - operator: in
                      property: domain_name
                      values:
                      - zoom.us
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Name of the application.
                            example: app1
                            type: string
                          client_agent_version:
                            description: Version of the client agent.
                            example: 1.0.0
                            type: string
                          client_os_version:
                            description: Version of the client OS.
                            example: Windows 10
                            type: string
                          client_public_address:
                            description: Public IP address of the client.
                            example: 1.1.1.1
                            type: string
                          device_isp_name:
                            description: ISP name.
                            example: Verizon
                            type: string
                          device_name:
                            description: Name of the device.
                            example: device1
                            type: string
                          device_score:
                            description: Device score.
                            example: 50
                            type: number
                          device_self_serve_status:
                            description: Self serve user enabled.
                            example: true
                            type: boolean
                          domain_name:
                            description: Application domain name.
                            example: zoom.us
                            type: string
                          edge_location_display_name:
                            description: Name of the PA location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: Experience score.
                            example: 50
                            type: number
                          instance_name:
                            description: Firewall name.
                            example: fw1
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 50
                            type: number
                          lan_score:
                            description: LAN score.
                            example: 50
                            type: number
                          location_group_name:
                            description: Location group name.
                            example: location_group1
                            type: string
                          pa_score:
                            description: PA score.
                            example: 50
                            type: number
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Project name.
                            example: project1
                            type: string
                          source_city:
                            description: Name of the source city.
                            example: San Jose
                            type: string
                          source_country:
                            description: Name of the source country.
                            example: US
                            type: string
                          usergroups:
                            description: User groups.
                            example: group1
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: Wifi score.
                            example: 50
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  device_count:
                    description: Number of connected devices.
                    example: 10
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Current Connected Device Data
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/current_connected_user_count:
    post:
      description: 'Retrieve the current number of connected users without filters.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-current_connected_user_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: device_name
                      values:
                      - device1
                    - operator: in
                      property: client_agent_version
                      values:
                      - 1.0.0
                    - operator: in
                      property: client_os_version
                      values:
                      - Windows 10
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: client_public_address
                      values:
                      - 1.1.1.1
                    - operator: in
                      property: usergroups
                      values:
                      - group1
                    - operator: in
                      property: application_name
                      values:
                      - app1
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: experience_score
                      values:
                      - 50
                    - operator: in
                      property: device_score
                      values:
                      - 50
                    - operator: in
                      property: lan_score
                      values:
                      - 50
                    - operator: in
                      property: wifi_score
                      values:
                      - 50
                    - operator: in
                      property: pa_score
                      values:
                      - 50
                    - operator: in
                      property: internet_score
                      values:
                      - 50
                    - operator: in
                      property: device_self_serve_status
                      values:
                      - true
                    - operator: in
                      property: device_isp_name
                      values:
                      - Verizon
                    - operator: in
                      property: instance_name
                      values:
                      - fw1
                    - operator: in
                      property: project_name
                      values:
                      - project1
                    - operator: in
                      property: location_group_name
                      values:
                      - location_group1
                    - operator: in
                      property: domain_name
                      values:
                      - zoom.us
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Name of the application.
                            example: app1
                            type: string
                          client_agent_version:
                            description: Version of the client agent.
                            example: 1.0.0
                            type: string
                          client_os_version:
                            description: Version of the client OS.
                            example: Windows 10
                            type: string
                          client_public_address:
                            description: Public IP address of the client.
                            example: 1.1.1.1
                            type: string
                          device_isp_name:
                            description: ISP name.
                            example: Verizon
                            type: string
                          device_name:
                            description: Name of the device.
                            example: device1
                            type: string
                          device_score:
                            description: Device score.
                            example: 50
                            type: number
                          device_self_serve_status:
                            description: Self serve user enabled.
                            example: true
                            type: boolean
                          domain_name:
                            description: Application domain name.
                            example: zoom.us
                            type: string
                          edge_location_display_name:
                            description: Name of the PA location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: Experience score.
                            example: 50
                            type: number
                          instance_name:
                            description: Firewall name.
                            example: fw1
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 50
                            type: number
                          lan_score:
                            description: LAN score.
                            example: 50
                            type: number
                          location_group_name:
                            description: Location group name.
                            example: location_group1
                            type: string
                          pa_score:
                            description: PA score.
                            example: 50
                            type: number
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Project name.
                            example: project1
                            type: string
                          source_city:
                            description: Name of the source city.
                            example: San Jose
                            type: string
                          source_country:
                            description: Name of the source country.
                            example: US
                            type: string
                          usergroups:
                            description: User groups.
                            example: group1
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: Wifi score.
                            example: 50
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Current connected user count.
                    example: 100
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Current Connected User Data
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/device_list:
    post:
      description: 'Retrieve a list of agent devices with non-ADEM score filters.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-device_list
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: device_name
                      values:
                      - device1
                    - operator: in
                      property: client_agent_version
                      values:
                      - 1.0.0
                    - operator: in
                      property: client_os_version
                      values:
                      - Windows 10
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: client_public_address
                      values:
                      - 1.1.1.1
                    - operator: in
                      property: usergroups
                      values:
                      - group1
                    - operator: in
                      property: application_name
                      values:
                      - app1
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: experience_score
                      values:
                      - 50
                    - operator: in
                      property: device_score
                      values:
                      - 50
                    - operator: in
                      property: lan_score
                      values:
                      - 50
                    - operator: in
                      property: wifi_score
                      values:
                      - 50
                    - operator: in
                      property: pa_score
                      values:
                      - 50
                    - operator: in
                      property: internet_score
                      values:
                      - 5
                    - operator: in
                      property: device_self_serve_status
                      values:
                      - true
                    - operator: in
                      property: device_isp_name
                      values:
                      - Verizon
                    - operator: in
                      property: instance_name
                      values:
                      - fw1
                    - operator: in
                      property: project_name
                      values:
                      - project1
                    - operator: in
                      property: location_group_name
                      values:
                      - location_group1
                    - operator: in
                      property: domain_name
                      values:
                      - zoom.us
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Name of the application.
                            example: app1
                            type: string
                          client_agent_version:
                            description: Version of the client agent.
                            example: 1.0.0
                            type: string
                          client_os_version:
                            description: Version of the client OS.
                            example: Windows 10
                            type: string
                          client_public_address:
                            description: Public IP address of the client.
                            example: 1.1.1.1
                            type: string
                          device_isp_name:
                            description: ISP name.
                            example: Verizon
                            type: string
                          device_name:
                            description: Name of the device.
                            example: device1
                            type: string
                          device_score:
                            description: Device score.
                            example: 50
                            type: number
                          device_self_serve_status:
                            description: Self serve user enabled.
                            example: true
                            type: boolean
                          domain_name:
                            description: Application domain name.
                            example: zoom.us
                            type: string
                          edge_location_display_name:
                            description: Name of the PA location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: Experience score.
                            example: 50
                            type: number
                          instance_name:
                            description: Firewall name.
                            example: fw1
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 50
                            type: number
                          lan_score:
                            description: LAN score.
                            example: 50
                            type: number
                          location_group_name:
                            description: Location group name.
                            example: location_group1
                            type: string
                          pa_score:
                            description: PA score.
                            example: 50
                            type: number
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Project name.
                            example: project1
                            type: string
                          source_city:
                            description: Name of the source city.
                            example: San Jose
                            type: string
                          source_country:
                            description: Name of the source country.
                            example: US
                            type: string
                          usergroups:
                            description: User groups.
                            example: group1
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: Wifi score.
                            example: 50
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  adem_username:
                    description: ADEM username.
                    example: adem_john.doe
                    type: string
                  client_agent_type:
                    description: Client agent type.
                    example: GP_AGENT
                    type: string
                  client_agent_version:
                    description: Client agent version.
                    example: 1.0.0
                    type: string
                  connect_method:
                    description: Connection method.
                    example: Agent
                    type: string
                  device_agent_uuid:
                    description: Device agent UUID.
                    example: 5ac5-6edd-4d3d-xxxx-0000
                    type: string
                  device_auth_type:
                    description: Device authentication type.
                    example: Cookie
                    type: string
                  device_client_private_address:
                    description: Device client private address.
                    example: 10.0.0.5
                    type: string
                  device_isp_name:
                    description: Device ISP name.
                    example: Verizon
                    type: string
                  device_last_activity_timestamp_epoc_millis:
                    description: Device last activity timestamp epoch milliseconds.
                    example: 1678886400000
                    type: integer
                  device_last_connected_pa_fw_location:
                    description: Device last connected PA firewall location.
                    example: US West
                    type: string
                  device_last_connected_source_city:
                    description: Device last connected source city.
                    example: San Jose
                    type: string
                  device_last_connected_source_country:
                    description: Device last connected source country.
                    example: USA
                    type: string
                  device_name:
                    description: Device name.
                    example: D-02Y50E3JH
                    type: string
                  device_os_version:
                    description: Device OS version.
                    example: Windows 10
                    type: string
                  device_score_value:
                    description: Device score value.
                    example: 80
                    type: number
                  device_self_serve_notifications_count_internet_connectivity:
                    description: Device self-serve notifications count for Internet connectivity.
                    example: 1
                    type: integer
                  device_self_serve_notifications_count_system_cpu:
                    description: Device self-serve notifications count for system CPU.
                    example: 1
                    type: integer
                  device_self_serve_notifications_count_system_cpu_memory:
                    description: Device self-serve notifications count for system CPU and memory.
                    example: 1
                    type: integer
                  device_self_serve_notifications_count_system_memory:
                    description: Device self-serve notifications count for system memory.
                    example: 1
                    type: integer
                  device_self_serve_notifications_count_total:
                    description: Total device self-serve notifications count.
                    example: 5
                    type: integer
                  device_self_serve_notifications_count_wifi_connectivity:
                    description: Device self-serve notifications count for WiFi connectivity.
                    example: 1
                    type: integer
                  device_self_serve_notifications_count_wifi_link_quality:
                    description: Device self-serve notifications count for WiFi link quality.
                    example: 1
                    type: integer
                  device_self_serve_notifications_count_wifi_ssid_change:
                    description: Device self-serve notifications count for WiFi SSID change.
                    example: 1
                    type: integer
                  device_self_serve_status:
                    description: Device self-serve status.
                    example: 'true'
                    type: string
                  device_source_ip_address:
                    description: Device source IP address.
                    example: 192.168.1.100
                    type: string
                  experience_score_value:
                    description: Experience score value.
                    example: 75
                    type: number
                  internet_score_value:
                    description: Internet score value.
                    example: 70
                    type: number
                  lan_score_value:
                    description: LAN score value.
                    example: 85
                    type: number
                  pa_score_value:
                    description: PA score value.
                    example: 95
                    type: number
                  username:
                    description: Username.
                    example: john.doe
                    type: string
                  wifi_score_value:
                    description: WiFi score value.
                    example: 90
                    type: number
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Agent Device List
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/risky_user_count:
    post:
      description: 'Retrieve the number of risky users.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-risky_user_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Count of risky users.
                    example: 17688
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Risky User Data
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/session_list:
    post:
      description: 'Retrieve a list of agent sessions.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-session_list
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: username
                      values:
                      - john.doe
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: pa_location_name
                      values:
                      - US West
                    - operator: in
                      property: fw_name
                      values:
                      - FW1
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: client_os_version
                      values:
                      - Windows 10
                    - operator: in
                      property: client_agent_version
                      values:
                      - 1.0.0
                    - operator: in
                      property: client_public_address
                      values:
                      - 203.0.113.45
                    - operator: in
                      property: device_name
                      values:
                      - DHCP
                    - operator: in
                      property: auth_type
                      values:
                      - Kerberos
                    - operator: in
                      property: project_name
                      values:
                      - ProjectA
                    - operator: in
                      property: location_group_name
                      values:
                      - LocationGroup1
                    - operator: in
                      property: device_isp_name
                      values:
                      - Verizon
                    - operator: in
                      property: usergroups
                      values:
                      - group1
                    - operator: in
                      property: domain_name
                      values:
                      - example.com
                    - operator: in
                      property: connection_method
                      values:
                      - AGENT
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          auth_type:
                            description: Authentication Type.
                            example: Kerberos
                            type: string
                          client_agent_version:
                            description: Client Agent Version.
                            example: 1.0.0
                            type: string
                          client_os_version:
                            description: Client OS Version.
                            example: Windows 10
                            type: string
                          client_public_address:
                            description: Client Public Address.
                            example: 203.0.113.45
                            type: string
                          device.connection_method:
                            description: Device Connect Method.
                            example: AGENT
                            type: string
                          device_isp_name:
                            description: ISP Name.
                            example: Verizon
                            type: string
                          device_name:
                            description: Device Name.
                            example: DHCP
                            type: string
                          domain_name:
                            description: Application Domain Name.
                            example: example.com
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          fw_name:
                            description: Firewall Name.
                            example: FW1
                            type: string
                          location_group_name:
                            description: Location Group Name.
                            example: LocationGroup1
                            type: string
                          pa_location_name:
                            description: Prisma Access Location Name.
                            example: US West
                            type: string
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Project Name.
                            example: ProjectA
                            type: string
                          source_city:
                            description: Source City Name.
                            example: San Jose
                            type: string
                          source_country:
                            description: Source Country Name.
                            example: US
                            type: string
                          usergroups:
                            description: User Groups.
                            example: group1,group2
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      - username
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  auth_type:
                    description: Authentication Type.
                    example: Kerberos
                    type: string
                  bh_compute_region:
                    description: BH Compute Region.
                    example: US East
                    type: string
                  bh_name:
                    description: BH Name.
                    example: BH1
                    type: string
                  client_agent_version:
                    description: Client Agent Version.
                    example: 1.0.0
                    type: string
                  client_os_version:
                    description: Client OS Version.
                    example: Windows 10
                    type: string
                  connected_pa_fw_location:
                    description: Connected PA Firewall Location.
                    example: US West
                    type: string
                  connected_source_city:
                    description: Connected Source City.
                    example: San Jose
                    type: string
                  connected_source_country:
                    description: Connected Source Country.
                    example: US
                    type: string
                  connection_state:
                    description: Connection State.
                    example: Connected
                    type: string
                  device_name:
                    description: Device Name.
                    example: DHCP
                    type: string
                  location_group_name:
                    description: Location Group Name.
                    example: LocationGroup1
                    type: string
                  login_timestamp_epoc_millis:
                    description: Login Timestamp Epoch Millis.
                    example: 1678886400000
                    type: integer
                  logout_timestamp_epoc_millis:
                    description: Logout Timestamp Epoch Millis.
                    example: 1678890000000
                    type: integer
                  project_name:
                    description: Project Name.
                    example: ProjectA
                    type: string
                  session_duration_seconds:
                    description: Session Duration Seconds.
                    example: 3600
                    type: integer
                  user_client_private_address:
                    description: User Client Private Address.
                    example: 192.168.1.100
                    type: string
                  user_source_ip_address:
                    description: User Source IP Address.
                    example: 203.0.113.45
                    type: string
                  username:
                    description: Username.
                    example: john.doe
                    type: string
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Agent Session List
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/unique_device_connections_list:
    post:
      description: 'Retrieve a list of unique device connections with user details.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-unique_device_connections_list
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: username
                      values:
                      - john.doe
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: source_country_name
                      values:
                      - US
                    - operator: in
                      property: source_city_name
                      values:
                      - San Jose
                    - operator: in
                      property: client_os_version
                      values:
                      - Windows 10
                    - operator: in
                      property: client_gp_version
                      values:
                      - 1.0.0
                    - operator: in
                      property: user_source_ip_address
                      values:
                      - 203.0.113.45
                    - operator: in
                      property: device_name
                      values:
                      - DHCP
                    - operator: in
                      property: auth_type
                      values:
                      - Kerberos
                    - operator: in
                      property: project_name
                      values:
                      - ProjectA
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          auth_type:
                            description: Authentication Type.
                            example: Kerberos
                            type: string
                          client_gp_version:
                            description: Client Agent Version.
                            example: 1.0.0
                            type: string
                          client_os_version:
                            description: Client OS Version.
                            example: Windows 10
                            type: string
                          device_name:
                            description: Device Name Source.
                            example: DHCP
                            type: string
                          edge_location_display_name:
                            description: Prisma Access Location Name.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Project Name.
                            example: ProjectA
                            type: string
                          source_city_name:
                            description: Source City Name.
                            example: San Jose
                            type: string
                          source_country_name:
                            description: Source Country Name.
                            example: US
                            type: string
                          user_source_ip_address:
                            description: Client Public Address.
                            example: 203.0.113.45
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      - username
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  auth_type:
                    description: Authentication Type.
                    example: Kerberos
                    type: string
                  client_address:
                    description: Client Private Address.
                    example: 192.468.1.100
                    type: string
                  client_address_v6:
                    description: Client Private Address.
                    example: 192.158.1.150
                    type: string
                  client_gp_version:
                    description: Client Agent Version.
                    example: 1.0.0
                    type: string
                  client_os_version:
                    description: Client OS Version.
                    example: Windows 10
                    type: string
                  client_private_address:
                    description: Client Private Address.
                    example: 192.168.1.100
                    type: string
                  client_private_address_v6:
                    description: Client Private Address.
                    example: 192.168.1.150
                    type: string
                  device_name:
                    description: Device Name.
                    example: Laptop1
                    type: string
                  last_connected_source_city:
                    description: Device Last Connected Source City.
                    example: San Jose
                    type: string
                  last_connected_source_country:
                    description: Device Last Connected Source Country.
                    example: US
                    type: string
                  last_pa_location:
                    description: Last PA Firewall Location.
                    example: US West
                    type: string
                  login_timestamp_epoc_millis:
                    description: Login Timestamp Epoch Millis.
                    example: 1678886400000
                    type: integer
                  logout_timestamp_epoc_millis:
                    description: Logout Timestamp Epoch Millis.
                    example: 1678890000000
                    type: integer
                  pa_location_count:
                    description: PA Location Count.
                    example: 1
                    type: integer
                  project_name:
                    description: Project Name.
                    example: ProjectA
                    type: string
                  session_duration_seconds:
                    description: Session Duration in Seconds.
                    example: 3600
                    type: integer
                  user_source_ip_address:
                    description: User Source IP Address.
                    example: 203.0.113.45
                    type: string
                  username:
                    description: Username.
                    example: john.doe
                    type: string
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Unique Device Connections List
      tags:
      - Agent Users API
  /insights/v3.0/resource/query/users/agent/user_list:
    post:
      description: 'Retrieve a list of agent users.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-user_list
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: device_name
                      values:
                      - device1
                    - operator: in
                      property: agent_version
                      values:
                      - 1.0.0
                    - operator: in
                      property: client_os_version
                      values:
                      - Windows 10
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: client_public_address
                      values:
                      - 1.1.1.1
                    - operator: in
                      property: source_ip
                      values:
                      - 192.168.1.1
                    - operator: in
                      property: usergroups
                      values:
                      - admin
                    - operator: in
                      property: application_name
                      values:
                      - Zoom
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: experience_score_aggregate_value
                      values:
                      - 90
                    - operator: in
                      property: device_score_aggregate_value
                      values:
                      - 80
                    - operator: in
                      property: lan_score_aggregate_value
                      values:
                      - 70
                    - operator: in
                      property: wifi_score_aggregate_value
                      values:
                      - 60
                    - operator: in
                      property: pa_score_aggregate_value
                      values:
                      - 50
                    - operator: in
                      property: internet_score_aggregate_value
                      values:
                      - 40
                    - operator: in
                      property: device_self_serve_status
                      values:
                      - true
                    - operator: in
                      property: device_isp_name
                      values:
                      - Verizon
                    - operator: in
                      property: instance_name
                      values:
                      - FW1
                    - operator: in
                      property: instance_name
                      values:
                      - instance1
                    - operator: in
                      property: project_name
                      values:
                      - project1
                    - operator: in
                      property: location_group_name
                      values:
                      - location_group1
                    - operator: in
                      property: domain_name
                      values:
                      - zoom.us
                    - operator: in
                      property: agent_type
                      values:
                      - Agent
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          agent_type:
                            description: Client agent type.
                            example: Agent
                            type: string
                          agent_version:
                            description: Client agent version.
                            example: 1.0.0
                            type: string
                          application_name:
                            description: Application name.
                            example: Zoom
                            type: string
                          client_os_version:
                            description: Client OS version.
                            example: Windows 10
                            type: string
                          device_isp_name:
                            description: ISP name.
                            example: Verizon
                            type: string
                          device_name:
                            description: Device name source.
                            example: device1
                            type: string
                          device_score_aggregate_value:
                            description: Device score.
                            example: 80
                            type: number
                          device_self_serve_status:
                            description: Self-serve user enabled.
                            example: true
                            type: boolean
                          domain_name:
                            description: Application domain name.
                            example: zoom.us
                            type: string
                          edge_location_display_name:
                            description: Prisma Access location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score_aggregate_value:
                            description: Experience score.
                            example: 90
                            type: number
                          instance_name:
                            description: Instance name.
                            example: instance1
                            type: string
                          internet_score_aggregate_value:
                            description: Internet score.
                            example: 40
                            type: number
                          lan_score_aggregate_value:
                            description: LAN score.
                            example: 70
                            type: number
                          location_group_name:
                            description: Location group name.
                            example: location_group1
                            type: string
                          pa_score_aggregate_value:
                            description: PA score.
                            example: 50
                            type: number
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          project_name:
                            description: Project name.
                            example: project1
                            type: string
                          source_city:
                            description: Source city name.
                            example: San Jose
                            type: string
                          source_country:
                            description: Source country name.
                            example: US
                            type: string
                          source_ip:
                            description: Source IP address.
                            example: 192.168.1.1
                            type: string
                          usergroups:
                            description: User groups.
                            example: admin
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                          wifi_score_aggregate_value:
                            description: WiFi score.
                            example: 60
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  accelerated:
                    description: Accelerated.
                    example: true
                    type: boolean
                  adem_username:
                    description: Adem Username.
                    example: john.doe@company.com
                    type: string
                  application_count:
                    description: Application count.
                    example: 5
                    type: integer
                  device_count:
                    description: Device count.
                    example: 2
                    type: integer
                  last_activity_timestamp_epoc_millis:
                    description: Last activity timestamp epoch millis.
                    example: 1678886400000
                    type: integer
                  location_group_name:
                    description: Location group name.
                    example: location_group1
                    type: string
                  project_name:
                    description: Project name.
                    example: project1
                    type: string
                  threat_count:
                    description: Threat count.
                    example: 714
                    type: integer
                  total_bytes:
                    description: Total bytes.
                    example: 179246404
                    type: integer
                  username:
                    description: Username.
                    example: john.doe
                    type: string
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Agent User List
      tags:
      - Agent Users API
components:
  securitySchemes:
    Bearer:
      scheme: bearer
      type: http