openapi: 3.2.0
info:
  version: 2.0.0
  title: GlobalProtect Application Settings API
  description: These APIs are used for defining and managing Prisma Access GlobalProtect services within Strata Cloud Manager.
  termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  contact:
    email: support@paloaltonetworks.com
    name: Palo Alto Networks Technical Support
    url: https://support.paloaltonetworks.com
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/config/mobile-agent/v1
  description: Current
- url: https://api.sase.paloaltonetworks.com/sse/config/v1/mobile-agent
  description: Legacy
security:
- scmToken: []
tags:
- name: Application Settings
  description: Application Settings
paths:
  /agent-profiles:
    get:
      tags:
      - Application Settings
      summary: List GlobalProtect agent profiles
      description: 'Retrieve a list of GlobalProtect agent profiles

        '
      operationId: ListGlobalProtectAgentProfiles
      parameters:
      - $ref: '#/components/parameters/name'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/offset'
      - $ref: '#/components/parameters/folder-mobileusers-required'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    allOf:
                    - type: array
                      items:
                        $ref: '#/components/schemas/agent-profiles'
                  limit:
                    type: integer
                    default: 200
                  offset:
                    type: integer
                    default: 0
                  total:
                    type: integer
        '400':
          $ref: '#/components/responses/bad_request_errors_basic'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '404':
          $ref: '#/components/responses/not_found'
        default:
          $ref: '#/components/responses/default_errors'
    post:
      tags:
      - Application Settings
      summary: Create a GlobalProtect agent profile
      description: 'Create a new GlobalProtect agent profile

        '
      operationId: CreateGlobalProtectAgentProfiles
      parameters:
      - $ref: '#/components/parameters/folder-mobileusers-required'
      requestBody:
        description: Created
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agent-profiles'
      responses:
        '201':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/agent-profiles'
        '400':
          $ref: '#/components/responses/bad_request_errors_basic_with_body'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '409':
          $ref: '#/components/responses/conflict_errors'
        default:
          $ref: '#/components/responses/default_errors'
    put:
      tags:
      - Application Settings
      summary: Update a GlobalProtect agent profile
      description: 'Update an existing GlobalProtect agent profile

        '
      operationId: UpdateGlobalProtectAgentProfiles
      parameters:
      - $ref: '#/components/parameters/folder-mobileusers-required'
      requestBody:
        description: OK
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/agent-profiles'
      responses:
        '200':
          $ref: '#/components/responses/http_ok'
        '400':
          $ref: '#/components/responses/bad_request_errors_basic_with_body'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '404':
          $ref: '#/components/responses/not_found'
        '409':
          $ref: '#/components/responses/conflict_errors'
        default:
          $ref: '#/components/responses/default_errors'
    delete:
      tags:
      - Application Settings
      summary: Delete a GlobalProtect agent profile
      description: 'Delete a GlobalProtect agent profile

        '
      operationId: DeleteGlobalProtectAgentProfiles
      parameters:
      - $ref: '#/components/parameters/name-required'
      - $ref: '#/components/parameters/folder-mobileusers-required'
      responses:
        '200':
          $ref: '#/components/responses/http_ok'
        '400':
          $ref: '#/components/responses/bad_request_errors_basic'
        '401':
          $ref: '#/components/responses/auth_errors'
        '403':
          $ref: '#/components/responses/access_errors'
        '404':
          $ref: '#/components/responses/not_found'
        '409':
          $ref: '#/components/responses/conflict_errors'
        default:
          $ref: '#/components/responses/default_errors'
components:
  examples:
    json_401_panui_auth_key_expired:
      summary: Key Expired
      value:
        _errors:
        - code: E016
          message: Key Expired
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_501_panui_restapi_method_not_supported:
      summary: Method Not Supported
      value:
        _errors:
        - code: E012
          message: Method Not Supported
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_400_panui_restapi_input_format_mismatch:
      summary: Input Format Mismatch
      value:
        _errors:
        - code: E003
          message: 'Input Format Mismatch: input-format=json'
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_501_panui_restapi_version_not_supported:
      summary: Version Not Supported
      value:
        _errors:
        - code: E012
          message: Version Not Supported
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_409_panui_mgmt_name_not_unique:
      summary: Name Not Unique
      value:
        _errors:
        - code: E006
          message: Name Not Unique
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_409_panui_mgmt_object_not_unique:
      summary: Object Not Unique
      value:
        _errors:
        - code: E016
          message: Object Not Unique
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_404_panui_mgmt_object_not_present:
      summary: Object Not Present
      value:
        _errors:
        - code: E005
          message: Object Not Present
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_400_panui_restapi_missing_body:
      summary: Missing Body
      value:
        _errors:
        - code: E003
          message: Missing Body
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_409_panui_mgmt_reference_not_zero:
      summary: Reference Not Zero
      value:
        _errors:
        - code: E009
          message: Reference Not Zero
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_400_panui_restapi_output_format_mismatch:
      summary: Output Format Mismatch
      value:
        _errors:
        - code: E003
          message: 'Output Format Mismatch: output-format=json Accept=xml'
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_400_panui_mgmt_invalid_command:
      summary: Invalid Command
      value:
        _errors:
        - code: E003
          message: Invalid Command
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_401_panui_auth_not_authenticated:
      summary: Not Authenticated
      value:
        _errors:
        - code: E016
          message: Not Authenticated
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_401_panui_auth_invalid_credential:
      summary: Invalid Credential
      value:
        _errors:
        - code: E016
          message: Invalid Credential
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_403_panui_auth_unauthorized:
      summary: Unauthorized
      value:
        _errors:
        - code: E007
          message: Unauthorized
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_400_panui_restapi_missing_query_parameter:
      summary: Missing Query Parameter
      value:
        _errors:
        - code: E003
          message: 'Missing Query Parameter: name'
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_405_panui_restapi_action_not_supported:
      summary: Action Not Supported
      value:
        _errors:
        - code: E012
          message: 'Action Not Supported: move'
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_400_panui_restapi_invalid_query_parameter:
      summary: Invalid Query Parameter
      value:
        _errors:
        - code: E003
          message: 'Invalid Query Parameter: location=invalid'
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_400_panui_mgmt_invalid_object:
      summary: Invalid Object
      value:
        _errors:
        - code: E003
          message: Invalid Object
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_400_panui_mgmt_malformed_command:
      summary: Malformed Command
      value:
        _errors:
        - code: E003
          message: Malformed Command
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_401_panui_auth_key_too_long:
      summary: Key Too Long
      value:
        _errors:
        - code: E016
          message: Key Too Long
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_504_panui_mgmt_session_timeout:
      summary: Session Timeout
      value:
        _errors:
        - code: '4'
          message: Session Timeout
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_401_panui_auth_need_password_change:
      summary: Need Password Change
      value:
        _errors:
        - code: E016
          message: The password needs to be changed.
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
    json_400_panui_mgmt_bad_xpath:
      summary: Bad XPath
      value:
        _errors:
        - code: E013
          message: Bad XPath
          details: {}
        _request_id: 123e4567-e89b-12d3-a456-426655440000
  schemas:
    agent-profiles:
      type: object
      properties:
        name:
          type: string
        folder:
          type: string
          default: Mobile Users
        agent_ui:
          type: object
          description: Agent UI configuration settings
          properties:
            agent_user_override_timeout:
              type: integer
              description: Agent disabled duration (minutes).  A value of `0` means the agent will remain disabled until manually enabled.
              minimum: 0
              maximum: 65535
              default: 0
            max_agent_user_overrides:
              type: integer
              description: The maximum number of times the agent can be disabled.  A value of `0` means there are no limits to the number of times the agent can be disabled.
              minimum: 0
              maximum: 25
              default: 0
            passcode:
              type: string
              format: password
              description: The passcode used to disable the agent
              minLength: 6
              maxLength: 64
            uninstall_password:
              type: string
              format: password
              description: The password used to uninstall the agent
              minLength: 6
              maxLength: 32
            welcome_page:
              type: object
              description: The welcome page displayed upon login
              properties:
                page:
                  type: string
        authentication_override:
          type: object
          properties:
            accept_cookie:
              type: object
              properties:
                cookie_lifetime:
                  type: object
                  properties:
                    lifetime_in_days:
                      type: number
                      minimum: 1
                      maximum: 365
                    lifetime_in_hours:
                      type: number
                      minimum: 1
                      maximum: 72
                    lifetime_in_minutes:
                      type: number
                      minimum: 1
                      maximum: 59
            cookie_encrypt_decrypt_cert:
              type: string
            generate_cookie:
              type: boolean
        certificate:
          type: object
          properties:
            criteria:
              type: object
              properties:
                certificate_profile:
                  type: string
        client_certificate:
          type: object
          properties:
            local:
              type: string
            scep:
              type: string
              maxLength: 255
        custom_checks:
          type: object
          properties:
            criteria:
              type: object
              properties:
                plist:
                  type: array
                  items:
                    type: object
                    properties:
                      name:
                        type: string
                      key:
                        type: array
                        items:
                          type: object
                          properties:
                            name:
                              type: string
                            negate:
                              type: boolean
                            value:
                              type: string
                              pattern: .*
                              maxLength: 1024
                      negate:
                        type: boolean
                registry_key:
                  type: array
                  items:
                    type: object
                    properties:
                      name:
                        type: string
                        maxLength: 1023
                      default_value_data:
                        type: string
                        maxLength: 1024
                      negate:
                        type: boolean
                      registry_value:
                        type: array
                        items:
                          type: object
                          properties:
                            name:
                              type: string
                            negate:
                              type: boolean
                            value_data:
                              type: string
        gateways:
          type: object
          properties:
            external:
              type: object
              properties:
                list:
                  type: array
                  items:
                    type: object
                    properties:
                      name:
                        type: string
                      choice:
                        type: object
                        oneOf:
                        - type: object
                          title: fqdn
                          properties:
                            fqdn:
                              type: string
                        - type: object
                          title: ip
                          properties:
                            ip:
                              type: object
                              properties:
                                ipv4:
                                  type: string
                                  pattern: ^([:0-9.])+$
                                  maxLength: 100
                                ipv6:
                                  type: string
                                  maxLength: 100
                      manual:
                        type: boolean
                        description: If this GlobalProtect gateway can be manually selected
                        default: false
                      priority_rule:
                        type: array
                        items:
                          type: object
                          properties:
                            name:
                              type: string
                            priority:
                              enum:
                              - '0'
                              - '1'
                              - '2'
                              - '3'
                              - '4'
                              - '5'
            internal:
              type: object
              properties:
                list:
                  type: array
                  items:
                    type: object
                    properties:
                      name:
                        type: string
                      choice:
                        type: object
                        oneOf:
                        - type: object
                          title: fqdn
                          properties:
                            fqdn:
                              type: string
                        - type: object
                          title: ip
                          properties:
                            ip:
                              type: object
                              properties:
                                ipv4:
                                  type: string
                                  pattern: ^([:0-9.])+$
                                  maxLength: 100
                                ipv6:
                                  type: string
                                  maxLength: 100
                      source_ip:
                        type: array
                        items:
                          type: string
        gp_app_config:
          type: object
          properties:
            config:
              type: array
              description: Currently we only support connect-method and tunnel-mtu as app-config
              items:
                type: object
                anyOf:
                - $ref: '#/components/schemas/connect-method'
                - $ref: '#/components/schemas/tunnel-mtu'
        hip_collection:
          type: object
          properties:
            certificate_profile:
              type: string
            collect_hip_data:
              type: boolean
            custom_checks:
              type: object
              properties:
                linux:
                  type: object
                  properties:
                    process_list:
                      type: array
                      items:
                        type: string
                mac_os:
                  type: object
                  properties:
                    plist:
                      type: array
                      items:
                        type: object
                        properties:
                          name:
                            type: string
                            description: Preference list
                            maxLength: 1023
                          key:
                            type: array
                            items:
                              type: string
                        required:
                        - name
                    process_list:
                      type: array
                      items:
                        type: string
                windows:
                  type: object
                  properties:
                    process_list:
                      type: array
                      items:
                        type: string
                    registry_key:
                      type: array
                      items:
                        type: object
                        properties:
                          name:
                            type: string
                            description: Registry key
                            maxLength: 1023
                          registry_value:
                            type: array
                            items:
                              type: string
                        required:
                        - name
            exclusion:
              type: object
              properties:
                category:
                  type: array
                  items:
                    type: object
                    properties:
                      name:
                        type: string
                      vendor:
                        type: array
                        items:
                          type: object
                          properties:
                            name:
                              type: string
                            product:
                              type: array
                              items:
                                type: string
            max_wait_time:
              type: number
              minimum: 10
              maximum: 60
        internal_host_detection:
          type: object
          properties:
            hostname:
              type: string
              description: Host name of the IPv4 in DNS record
              pattern: ^[a-zA-Z0-9._-]+$
              maxLength: 256
            ip_address:
              type: string
              description: Internal IPv4 address of a host
        internal_host_detection_v6:
          type: object
          properties:
            hostname:
              type: string
              description: Host name of the IPv4 in DNS record
              pattern: ^[a-zA-Z0-9._-]+$
              maxLength: 256
            ip_address:
              type: string
              description: Internal IPv6 address of a host
        machine_account_exists_with_serialno:
          type: object
          properties:
            'yes':
              type: object
            'no':
              type: object
        os:
          type: array
          items:
            enum:
            - Android
            - Chrome
            - IoT
            - Linux
            - Mac
            - Windows
            - WindowsUWP
            - iOS
        save_user_credentials:
          enum:
          - '0'
          - '1'
          - '2'
          - '3'
        source_user:
          type: array
          items:
            type: string
        third_party_vpn_clients:
          type: array
          items:
            enum:
            - PAN Virtual Ethernet Adapter
            - Juniper Network Virtual Adapter
            - Cisco Systems VPN Adapter
      required:
      - name
    generic_error:
      type: object
      properties:
        _errors:
          $ref: '#/components/schemas/error_detail_cause_infos'
        _request_id:
          type: string
      x-examples: {}
    error_detail_cause_info:
      type: object
      title: Cause Info
      properties:
        code:
          type: string
        message:
          type: string
        details:
          oneOf:
          - type: string
          - type: object
        help:
          type: string
    tunnel-mtu:
      type: object
      properties:
        name:
          enum:
          - tunnel-mtu
          default: tunnel-mtu
        value:
          type: array
          description: GlobalProtect Connection MTU (bytes)
          minItems: 1
          maxItems: 1
          items:
            type: number
            minimum: 1000
            maximum: 1420
            default: 1400
    error_detail_cause_infos:
      type: array
      items:
        $ref: '#/components/schemas/error_detail_cause_info'
      x-examples: {}
    connect-method:
      type: object
      properties:
        name:
          enum:
          - connect-method
          default: connect-method
        value:
          type: array
          minItems: 1
          maxItems: 1
          items:
            enum:
            - user-logon
            - pre-logon
            - on-demand
            - pre-logon-then-on-demand
  responses:
    http_ok:
      description: OK
    not_found:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/generic_error'
          examples:
            object_not_present:
              $ref: '#/components/examples/json_404_panui_mgmt_object_not_present'
    default_errors:
      description: General Errors
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/generic_error'
          examples:
            version_not_supported:
              $ref: '#/components/examples/json_501_panui_restapi_version_not_supported'
            method_not_allowed:
              $ref: '#/components/examples/json_501_panui_restapi_method_not_supported'
            action_not_supported:
              $ref: '#/components/examples/json_405_panui_restapi_action_not_supported'
            bad_xpath:
              $ref: '#/components/examples/json_400_panui_mgmt_bad_xpath'
            invalid_command:
              $ref: '#/components/examples/json_400_panui_mgmt_invalid_command'
            malformed_command:
              $ref: '#/components/examples/json_400_panui_mgmt_malformed_command'
            session_timeout:
              $ref: '#/components/examples/json_504_panui_mgmt_session_timeout'
    bad_request_errors_basic_with_body:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/generic_error'
          examples:
            input_format_mismatch:
              $ref: '#/components/examples/json_400_panui_restapi_input_format_mismatch'
            output_format_mismatch:
              $ref: '#/components/examples/json_400_panui_restapi_output_format_mismatch'
            missing_query_parameter:
              $ref: '#/components/examples/json_400_panui_restapi_missing_query_parameter'
            invalid_query_parameter:
              $ref: '#/components/examples/json_400_panui_restapi_invalid_query_parameter'
            missing_body:
              $ref: '#/components/examples/json_400_panui_restapi_missing_body'
            invalid_object:
              $ref: '#/components/examples/json_400_panui_mgmt_invalid_object'
    bad_request_errors_basic:
      description: Bad Request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/generic_error'
          examples:
            input_format_mismatch:
              $ref: '#/components/examples/json_400_panui_restapi_input_format_mismatch'
            output_format_mismatch:
              $ref: '#/components/examples/json_400_panui_restapi_output_format_mismatch'
            missing_query_parameter:
              $ref: '#/components/examples/json_400_panui_restapi_missing_query_parameter'
            invalid_query_parameter:
              $ref: '#/components/examples/json_400_panui_restapi_invalid_query_parameter'
    auth_errors:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/generic_error'
          examples:
            auth_not_authenticated:
              $ref: '#/components/examples/json_401_panui_auth_not_authenticated'
            invalid_credential:
              $ref: '#/components/examples/json_401_panui_auth_invalid_credential'
            key_too_long:
              $ref: '#/components/examples/json_401_panui_auth_key_too_long'
            key_expired:
              $ref: '#/components/examples/json_401_panui_auth_key_expired'
            need_password_change:
              $ref: '#/components/examples/json_401_panui_auth_need_password_change'
    conflict_errors:
      description: Conflict
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/generic_error'
          examples:
            object_not_unique:
              $ref: '#/components/examples/json_409_panui_mgmt_object_not_unique'
            name_not_unique:
              $ref: '#/components/examples/json_409_panui_mgmt_name_not_unique'
            reference_not_zero:
              $ref: '#/components/examples/json_409_panui_mgmt_reference_not_zero'
    access_errors:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/generic_error'
          examples:
            auth_unauthorized:
              $ref: '#/components/examples/json_403_panui_auth_unauthorized'
  parameters:
    name:
      name: name
      in: query
      description: The name of the configuration resource
      required: false
      schema:
        type: string
    limit:
      name: limit
      in: query
      description: The maximum number of results per page
      required: false
      schema:
        type: integer
        default: 200
    folder-mobileusers-required:
      name: folder
      in: query
      description: 'The folder in which the resource is defined

        '
      schema:
        enum:
        - Mobile Users
    offset:
      name: offset
      in: query
      description: The offset into the list of results returned
      required: false
      schema:
        type: integer
        default: 0
    name-required:
      name: name
      in: query
      description: The name of the configuration resource
      required: true
      schema:
        type: string
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: "Strata Cloud Manager APIs authenticate client requests using the \nOAuth 2.0 Client Credentials flow.  Please use the `client_id`, \n`client_secret` values associated with an IAM service account along \nwith a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the \nTenant Service Group (TSG) ID.  The resulting JWT access token should \nbe attached to all API calls as a `Bearer` token in the `Authorization` \nheader (ex. `Authorization: Bearer tokenstring`).\n"
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: "Strata Cloud Manager APIs authenticate client requests using the \nOAuth 2.0 Client Credentials flow.  Please use the `client_id`, \n`client_secret` values associated with an IAM service account along \nwith a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the \nTenant Service Group (TSG) ID.  The resulting JWT access token should \nbe attached to all API calls as a `Bearer` token in the `Authorization` \nheader (ex. `Authorization: Bearer tokenstring`).\n"
      scheme: bearer
      bearerFormat: JWT
x-internal: false