openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Event Logs API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Event Logs
  description: APIs for Event Logs.
paths:
  /v1/activitylogsearch:
    post:
      description: Request specific event log data that matches your filter criteria and include a total count of entries in the response.
      operationId: activitylogs_getByExpression
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActivityLogFilter'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ActivityLogEntriesResponse'
          description: Total count and list of matching log entries.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse9'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse9'
          description: Incomplete or malformed request.
      summary: Retrieve count and activity log entries
      tags:
      - Event Logs
  /v1/activitylogsearch/export:
    post:
      description: Request specific event log data that matches your filter criteria. You can even specify the format in the header as either JSON or CSV.
      operationId: activitylogs_getAllByExpression
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ActivityLogFilter'
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/ExportedActivityLogEntryInformation'
                type: array
            text/csv:
              schema:
                type: string
          description: List of matching log entries.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse9'
            text/csv:
              schema:
                $ref: '#/components/schemas/ErrorResponse9'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse9'
            text/csv:
              schema:
                $ref: '#/components/schemas/ErrorResponse9'
          description: Incomplete or malformed request.
      summary: Export filtered event log data to
      tags:
      - Event Logs
  /v1/activitytypes:
    get:
      description: Retrieve types of activities used for event logging, such as failed login attempts or events that are critical. Learn more about [event logging](https://docs.venafi.cloud/vaas/logging/c-about-activity-logging/).
      operationId: activitylogtypes_get
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/ActivityLogType'
                type: array
          description: Types of activities in event logging; details in response body
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse9'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse9'
          description: Incomplete or malformed request.
      summary: Retrieve types of activities used for
      tags:
      - Event Logs
components:
  schemas:
    ActivityLogOrder:
      properties:
        direction:
          $ref: '#/components/schemas/Direction'
        field:
          description: A field, that will be used for ordering
          example: activityDate
          type: string
      type: object
    ActivityLogFilter:
      properties:
        expression:
          $ref: '#/components/schemas/BaseActivityLogFilter'
        ordering:
          $ref: '#/components/schemas/BaseActivityLogOrdering'
        paging:
          $ref: '#/components/schemas/Page2'
      type: object
    NaryOperator:
      description: An operator for filtering
      enum:
      - AND
      - OR
      example: OR
      type: string
    ErrorInformation9:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue9'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    BaseActivityLogOrdering:
      description: Specify the ordering of a search result
      properties:
        orders:
          items:
            $ref: '#/components/schemas/ActivityLogOrder'
          type: array
      type: object
    ActivityLogFilterOperator:
      description: An operator for filtering
      enum:
      - EQ
      - LT
      - LTE
      - GT
      - GTE
      - IN
      example: EQ
      type: string
    ActivityLogEntriesResponse:
      properties:
        activityLogEntries:
          description: A collection of activity log entries
          items:
            $ref: '#/components/schemas/ActivityLogEntryInformation'
          type: array
        count:
          description: The number of activity log entries.
          example: 2
          format: int64
          type: integer
      type: object
    Page2:
      description: Specify pagination on the search request
      properties:
        pageNumber:
          description: page number
          example: 0
          format: int32
          type: integer
        pageSize:
          description: page size
          example: 10
          format: int32
          type: integer
      type: object
    ActivityLogType:
      properties:
        key:
          type: string
        readableName:
          type: string
        values:
          items:
            $ref: '#/components/schemas/ActivityLogName'
          type: array
      type: object
    UnaryOperator:
      description: An operator for filtering
      enum:
      - NOT
      example: NOT
      type: string
    ActivityLogFilterOperand:
      properties:
        operand:
          $ref: '#/components/schemas/ActivityLogCondition'
        operator:
          $ref: '#/components/schemas/UnaryOperator'
      type: object
    ActivityLogEntryInformation:
      properties:
        activityDate:
          description: The date when a log entry was produced
          example: '2023-01-24T09:12:28Z'
          format: date-time
          type: string
        activityName:
          description: An activity name
          example: Login Succeeded
          type: string
        activityType:
          description: An activity type
          example: Authentication
          type: string
        companyId:
          description: UUID of a company
          example: 85595df0-8e14-11ed-87e3-755db050f29d
          format: uuid
          type: string
        criticality:
          description: An activity criticality
          example: 0
          format: int32
          type: integer
        id:
          description: UUID of a log entry
          example: 2eb29780-9046-11ed-8e50-b994b27d2ece
          format: uuid
          type: string
        message:
          description: An activity log message
          example: user logged in
          type: string
        payload:
          additionalProperties:
            type: string
          type: object
        tsgId:
          description: TSG ID of a company
          example: '1234567890'
          type: string
      type: object
    ActivityLogFilterOperands:
      properties:
        operands:
          description: A list of conditions that will be used for filtering
          example:
          - field: activityType
            operator: EQ
            value: Authentication
          - field: activityName
            operator: EQ
            value: Login Succeeded
          items:
            $ref: '#/components/schemas/BaseActivityLogFilter'
          type: array
        operator:
          $ref: '#/components/schemas/NaryOperator'
      type: object
    Direction:
      description: An ordering direction
      enum:
      - ASC
      - DESC
      example: DESC
      type: string
    ExportedActivityLogEntryInformation:
      properties:
        activityDate:
          description: The date when a log entry was produced
          example: '2023-01-24T09:12:28Z'
          format: date-time
          type: string
        activityName:
          description: An activity name
          example: Login Succeeded
          type: string
        activityType:
          description: An activity type
          example: Authentication
          type: string
        criticality:
          description: An activity criticality
          example: 0
          format: int32
          type: integer
        id:
          description: UUID of a log entry
          example: 2eb29780-9046-11ed-8e50-b994b27d2ece
          format: uuid
          type: string
        message:
          description: An activity log message
          example: user logged in
          type: string
        payload:
          additionalProperties:
            type: string
          type: object
      type: object
    ErrorResponse9:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation9'
          type: array
      type: object
    ActivityLogCondition:
      description: A Condition for filtering
      properties:
        field:
          description: Represents a field for filtering
          example: activityType
          type: string
        operator:
          $ref: '#/components/schemas/ActivityLogFilterOperator'
        value:
          description: represents a field's value
          example: Authentication
          type: string
        values:
          description: represents a field's values
          example:
          - Authentication
          - Users
          items:
            type: string
          type: array
      type: object
    ActivityLogName:
      properties:
        key:
          type: string
        readableName:
          type: string
      type: object
    AnyValue9:
      description: Can be any value - string, number, boolean, array or object.
    BaseActivityLogFilter:
      description: Root expression for filtering
      oneOf:
      - $ref: '#/components/schemas/ActivityLogFilterOperands'
      - $ref: '#/components/schemas/ActivityLogFilterOperand'
      - $ref: '#/components/schemas/ActivityLogCondition'
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT