openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Machine Installations API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Machine Installations
  description: APIs for Machine Installations.
paths:
  /v1/machineidentities:
    get:
      description: Retrieves the details of all machine identities..
      operationId: machineidentities_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineIdentityResponse'
          description: All Machine Identities for the company.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Get the details of all machine
      tags:
      - Machine Installations
    post:
      description: Creates a machine identity for a machine.
      operationId: machineidentities_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachineIdentityCreationRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineIdentityInformation'
          description: Machine Identity was created; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Add a machine identity to a
      tags:
      - Machine Installations
  /v1/machineidentities/{id}:
    get:
      description: Retrieves the machine identity that has the specified `id`.
      operationId: machineidentities_getById
      parameters:
      - description: UUID of a Machine Identity.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine Identity.
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineIdentityInformation'
          description: Machine Identity matching specified id
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Request Conditions Failed
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Machine Identity not found
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Request Conditions Failed
      summary: Get a machine identity details
      tags:
      - Machine Installations
    delete:
      description: Deletes the machine identity that has the specified `id`.
      operationId: machineidentities_delete
      parameters:
      - description: UUID of a Machine Identity.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine Identity.
          format: uuid
          type: string
      responses:
        '204':
          description: Machine Identity was deleted.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Machine Identity not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Remove a machine identity
      tags:
      - Machine Installations
    patch:
      description: CUpdates specific details of the machine identity that has the specified `id`.
      operationId: machineidentities_update
      parameters:
      - description: UUID of a Machine Identity.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine Identity.
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachineIdentityUpdateRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineIdentityInformation'
          description: Machine Identity was updated; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Machine Identity not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Update a machine identity details
      tags:
      - Machine Installations
  /v1/machineidentities/{id}/workflows:
    post:
      description: Used to initiate a workflow like 'testConnection' for the machine that has the specified `id`.
      operationId: machineidentities_initiateWorkflow
      parameters:
      - description: UUID of a Machine Identity.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine Identity.
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachineIdentityWorkflowRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineIdentityWorkflowInformation'
          description: Workflow was initiated; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Machine identity not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Initiate a machine workflow
      tags:
      - Machine Installations
  /v1/machineidentitysearch:
    post:
      description: Retrieves the details of machine identities that match the specified [search expression](https://docs.venafi.cloud/CSH_api_search).
      operationId: getMachineIdentitiesByExpression
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachineIdentitySearchRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineIdentityDocumentResponse'
          description: Details of Machine Identities in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Get the details of machine identities
      tags:
      - Machine Installations
components:
  schemas:
    MachineIdentityDocumentResponse:
      properties:
        machineIdentities:
          items:
            $ref: '#/components/schemas/MachineIdentityDocumentInformation'
          type: array
      type: object
    ErrorInformation3:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue3'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    MachineIdentityUpdateRequest:
      properties:
        binding:
          $ref: '#/components/schemas/AnyValue3'
        certificateId:
          format: uuid
          type: string
        keystore:
          $ref: '#/components/schemas/AnyValue3'
      type: object
    MachineIdentityResponse:
      properties:
        machineIdentities:
          items:
            $ref: '#/components/schemas/MachineIdentityInformation'
          type: array
      type: object
    OrderObject:
      properties:
        direction:
          enum:
          - ASC
          - DESC
          type: string
        field:
          type: string
      type: object
    Ordering:
      properties:
        orders:
          items:
            $ref: '#/components/schemas/OrderObject'
          type: array
      type: object
    Expression:
      type: object
    ProvisionCertificateWorkflowInputInformation:
      properties:
        wsClientId:
          minLength: 1
          type: string
      required:
      - wsClientId
      type: object
    MachineIdentityCreationRequest:
      properties:
        binding:
          $ref: '#/components/schemas/AnyValue3'
        certificateId:
          format: uuid
          type: string
        keystore:
          $ref: '#/components/schemas/AnyValue3'
        machineId:
          format: uuid
          type: string
      required:
      - certificateId
      - machineId
      type: object
    MachineIdentitySearchRequest:
      properties:
        expression:
          $ref: '#/components/schemas/Expression'
        ordering:
          $ref: '#/components/schemas/Ordering'
        paging:
          $ref: '#/components/schemas/Paging'
      type: object
    MachineIdentityWorkflowRequest:
      properties:
        workflowInput:
          $ref: '#/components/schemas/ProvisionCertificateWorkflowInputInformation'
        workflowName:
          type: string
      required:
      - workflowName
      type: object
    MachineIdentityInformation:
      properties:
        binding:
          $ref: '#/components/schemas/AnyValue3'
        certificateId:
          format: uuid
          type: string
        companyId:
          format: uuid
          type: string
        creationDate:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        keystore:
          $ref: '#/components/schemas/AnyValue3'
        lastSeenOn:
          format: date-time
          type: string
        machineId:
          format: uuid
          type: string
        metadata:
          $ref: '#/components/schemas/AnyValue3'
        modificationDate:
          format: date-time
          type: string
        status:
          enum:
          - NEW
          - PENDING
          - INSTALLED
          - DISCOVERED
          - VALIDATED
          - MISSING
          - FAILED
          type: string
      type: object
    ErrorResponse3:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation3'
          type: array
      type: object
    Paging:
      properties:
        pageNumber:
          format: int32
          type: integer
        pageSize:
          format: int32
          type: integer
      type: object
    MachineIdentityWorkflowInformation:
      properties:
        workflowId:
          type: string
        workflowName:
          type: string
      type: object
    AnyValue3:
      description: Can be any value - string, number, boolean, array or object.
    MachineIdentityDocumentInformation:
      properties:
        applicationIds:
          items:
            format: uuid
            type: string
          type: array
        binding:
          $ref: '#/components/schemas/AnyValue3'
        certificateFingerprint:
          type: string
        certificateId:
          format: uuid
          type: string
        certificateName:
          type: string
        certificateValidityEnd:
          format: date-time
          type: string
        companyId:
          format: uuid
          type: string
        creationDate:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        keystore:
          $ref: '#/components/schemas/AnyValue3'
        lastSeenOn:
          format: date-time
          type: string
        machineId:
          format: uuid
          type: string
        machineName:
          type: string
        metadata:
          $ref: '#/components/schemas/AnyValue3'
        modificationDate:
          format: date-time
          type: string
        status:
          enum:
          - NEW
          - PENDING
          - INSTALLED
          - DISCOVERED
          - VALIDATED
          - MISSING
          - FAILED
          type: string
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT