openapi: 3.2.0
info:
  contact:
    email: support@paloaltonetworks.com
  description: 'The Open API specification file represents the APIs available for Prisma Access Insights 3.0.

    The Prisma Access Insights 3.0 APIs allow you to query your Prisma Access tenant for the health of

    your Prisma Access network deployment. The 3.0 APIs are intended for cloud-managed Prisma Access

    customers, where the tenants have been onboarded by Palo Alto Networks using a Tenant Service Group

    (TSG) identifier.


    These APIs use the common SASE authentication mechanism and base URL. See the

    [Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information.


    This Open API spec file was created on May 30, 2025. To check for a more recent version of this file, see

    [Prisma Insights APIs on pan.dev](https://pan.dev//access/api/insights/).


    © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo

    Alto Networks. A list of our trademarks can be found at


    [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html)


    All other marks mentioned herein may be trademarks of their respective companies.

    '
  license:
    name: MIT
    url: https://opensource.org/license/mit
  termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  title: Palo Alto Networks 3.0 Branch User API API
  version: '3.0'
servers:
- url: https://api.sase.paloaltonetworks.com
tags:
- name: Branch User API
paths:
  /insights/v3.0/resource/export/query/users/branch/user_list:
    post:
      description: 'Export a list of users, including details on devices and applications.

        '
      operationId: post-insights-v3.0-resource-export-query-users-branch-user_list
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: app
                      values:
                      - Zoom
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: instance_name
                      values:
                      - instance1
                    - operator: in
                      property: user_source_ip_address
                      values:
                      - 192.168.1.1
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Application name.
                            example: Zoom
                            type: string
                          edge_location_display_name:
                            description: Prisma Access Location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          instance_name:
                            description: Instance name.
                            example: instance1
                            type: string
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          source_city:
                            description: City from GeoIP.
                            example: San Jose
                            type: string
                          source_country:
                            description: Country from GeoIP.
                            example: US
                            type: string
                          user_source_ip_address:
                            description: Source IP address.
                            example: 192.168.1.1
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  application_count:
                    description: Number of applications.
                    example: 5
                    type: integer
                  device_auth_type:
                    description: Device authentication type.
                    example: certificate
                    type: string
                  device_client_private_address:
                    description: Device client private address.
                    example: 10.0.0.200
                    type: string
                  device_count:
                    description: Number of devices.
                    example: 2
                    type: integer
                  device_last_activity_timestamp_epoc_millis:
                    description: Device last activity timestamp in epoch milliseconds.
                    example: 1678886500000
                    type: integer
                  device_last_connected_pa_fw_location:
                    description: Device last connected PA FW location.
                    example: US East
                    type: string
                  device_last_connected_source_city:
                    description: Device last connected source city.
                    example: New York
                    type: string
                  device_last_connected_source_country:
                    description: Device last connected source country.
                    example: USA
                    type: string
                  device_name:
                    description: Device name.
                    example: device1
                    type: string
                  device_os_version:
                    description: Device OS version.
                    example: iOS 15
                    type: string
                  device_source_ip_address:
                    description: Device source IP address.
                    example: 192.168.1.200
                    type: string
                  threat_count:
                    description: Number of threats.
                    example: 10
                    type: integer
                  total_bytes:
                    description: Total bytes transferred.
                    example: 1000000
                    type: integer
                  user_client_private_address:
                    description: User client private address.
                    example: 10.0.0.100
                    type: string
                  user_client_source_address:
                    description: User client source address.
                    example: 192.168.1.100
                    type: string
                  user_last_activity_timestamp_epoc_millis:
                    description: User last activity timestamp in epoch milliseconds.
                    example: 1678886400000
                    type: integer
                  user_last_connected_pa_fw_location:
                    description: Last connected PA FW location.
                    example: US West
                    type: string
                  user_last_connected_source_city:
                    description: User last connected source city.
                    example: San Francisco
                    type: string
                  user_last_connected_source_country:
                    description: User last connected source country.
                    example: USA
                    type: string
                  user_os_version:
                    description: User OS version.
                    example: Windows 10
                    type: string
                  username:
                    description: Username.
                    example: john.doe
                    type: string
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Export Branch User List
      tags:
      - Branch User API
  /insights/v3.0/resource/query/branch/risky_user_count:
    post:
      description: 'Retrieve the number of risky users based on the applied filters.

        '
      operationId: post-insights-v3.0-resource-query-branch-risky_user_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          username:
                            description: Name of the source user.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Count of risky users.
                    example: 10034
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Risky User Data
      tags:
      - Branch User API
  /insights/v3.0/resource/query/users/branch/active_user_count:
    post:
      description: 'Retrieve the number of active branch users.

        '
      operationId: post-insights-v3.0-resource-query-users-branch-active_user_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Count of active users.
                    example: 10045
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Active Branch User Data
      tags:
      - Branch User API
  /insights/v3.0/resource/query/users/branch/active_user_list:
    post:
      description: 'Retrieve a list of active branch users.

        '
      operationId: post-insights-v3.0-resource-query-users-branch-active_user_list
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: username
                      values:
                      - achalla1kerbuser
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          username:
                            description: Username.
                            example: achalla1kerbuser
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  last_activity_epoc_time_millis:
                    description: Last activity epoch time in milliseconds.
                    example: 1678886400000
                    type: integer
                  pa_fw_location:
                    description: PA Firewall location.
                    example: US West
                    type: string
                  user_last_connected_source_city:
                    description: Source city.
                    example: San Francisco
                    type: string
                  user_last_connected_source_country:
                    description: Source country.
                    example: USA
                    type: string
                  user_source_ip:
                    description: User source IP address.
                    example: 192.168.1.1
                    type: string
                  username:
                    description: Username.
                    example: john.doe
                    type: string
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Active Branch User List
      tags:
      - Branch User API
  /insights/v3.0/resource/query/users/branch/connected_entity_count:
    post:
      description: 'Retrieve the number of connected entities for branch users.

        '
      operationId: post-insights-v3.0-resource-query-users-branch-connected_entity_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          username:
                            description: Source user name.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  device_count:
                    description: Count of connected devices.
                    example: 104
                    type: integer
                  user_count:
                    description: Count of connected users.
                    example: 1034
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Connected Entity Data for Branch Users
      tags:
      - Branch User API
  /insights/v3.0/resource/query/users/branch/session_list:
    post:
      description: 'Retrieve a list of branch user sessions.

        '
      operationId: post-insights-v3.0-resource-query-users-branch-session_list
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  bytes_received:
                    description: Bytes received.
                    example: 2048.0
                    format: float
                    type: number
                  bytes_sent:
                    description: Bytes sent.
                    example: 1024.0
                    format: float
                    type: number
                  login_time:
                    description: Login time.
                    example: '2023-03-15T00:00:00Z'
                    type: string
                  pa_fw_location:
                    description: PA Firewall location.
                    example: US West
                    type: string
                  user_client_private_address:
                    description: User client IP address.
                    example: 192.165.0.1
                    type: string
                  user_client_source_address:
                    description: User client IP address.
                    example: 192.168.1.1
                    type: string
                  user_last_connected_source_city:
                    description: Source city.
                    example: San Francisco
                    type: string
                  user_last_connected_source_country:
                    description: Source country.
                    example: USA
                    type: string
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Branch User Session List
      tags:
      - Branch User API
  /insights/v3.0/resource/query/users/branch/user_count_histogram:
    post:
      description: 'Retrieve a histogram of branch user data.

        '
      operationId: post-insights-v3.0-resource-query-users-branch-user_count_histogram
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                  histogram:
                    enableEmptyInterval: true
                    property: event_time
                    range: minute
                    value: 30
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          platform_type:
                            description: Platform type.
                            example: prisma_access
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  event_time:
                    description: Event time
                    example: 1709226000000
                    type: number
                  user_count:
                    description: Number of users
                    example: 1045
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Branch User Histogram Data
      tags:
      - Branch User API
  /insights/v3.0/resource/query/users/branch/user_list:
    post:
      description: 'Retrieve a list of users, including details on devices and applications.

        '
      operationId: post-insights-v3.0-resource-query-users-branch-user_list
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: app
                      values:
                      - Zoom
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: instance_name
                      values:
                      - instance1
                    - operator: in
                      property: user_source_ip_address
                      values:
                      - 192.168.1.1
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Application name.
                            example: Zoom
                            type: string
                          edge_location_display_name:
                            description: Prisma Access Location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          instance_name:
                            description: Instance name.
                            example: instance1
                            type: string
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          source_city:
                            description: City from GeoIP.
                            example: San Jose
                            type: string
                          source_country:
                            description: Country from GeoIP.
                            example: US
                            type: string
                          user_source_ip_address:
                            description: Source IP address.
                            example: 192.168.1.1
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  application_count:
                    description: Number of applications.
                    example: 5
                    type: integer
                  device_auth_type:
                    description: Device authentication type.
                    example: certificate
                    type: string
                  device_client_private_address:
                    description: Device client private address.
                    example: 10.0.0.200
                    type: string
                  device_count:
                    description: Number of devices.
                    example: 2
                    type: integer
                  device_last_activity_timestamp_epoc_millis:
                    description: Device last activity timestamp in epoch milliseconds.
                    example: 1678886500000
                    type: integer
                  device_last_connected_pa_fw_location:
                    description: Device last connected PA FW location.
                    example: US East
                    type: string
                  device_last_connected_source_city:
                    description: Device last connected source city.
                    example: New York
                    type: string
                  device_last_connected_source_country:
                    description: Device last connected source country.
                    example: USA
                    type: string
                  device_name:
                    description: Device name.
                    example: device1
                    type: string
                  device_os_version:
                    description: Device OS version.
                    example: iOS 15
                    type: string
                  device_source_ip_address:
                    description: Device source IP address.
                    example: 192.168.1.200
                    type: string
                  threat_count:
                    description: Number of threats.
                    example: 10
                    type: integer
                  total_bytes:
                    description: Total bytes transferred.
                    example: 1000000
                    type: integer
                  user_client_private_address:
                    description: User client private address.
                    example: 10.0.0.100
                    type: string
                  user_client_source_address:
                    description: User client source address.
                    example: 192.168.1.100
                    type: string
                  user_last_activity_timestamp_epoc_millis:
                    description: User last activity timestamp in epoch milliseconds.
                    example: 1678886400000
                    type: integer
                  user_last_connected_pa_fw_location:
                    description: Last connected PA FW location.
                    example: US West
                    type: string
                  user_last_connected_source_city:
                    description: User last connected source city.
                    example: San Francisco
                    type: string
                  user_last_connected_source_country:
                    description: User last connected source country.
                    example: USA
                    type: string
                  user_os_version:
                    description: User OS version.
                    example: Windows 10
                    type: string
                  username:
                    description: Username.
                    example: john.doe
                    type: string
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Branch User List
      tags:
      - Branch User API
components:
  securitySchemes:
    Bearer:
      scheme: bearer
      type: http