openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager Machines API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: Machines
  description: APIs for Machines.
paths:
  /v1/machines:
    get:
      description: Retrieves the details of all machines.
      operationId: machines_getAll
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachinesResponse'
          description: Details of Machines in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Get the details of all machines
      tags:
      - Machines
    post:
      description: Creates a machine corresponding to the specified `pluginId`.
      operationId: machines_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachineCreationRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineInformation'
          description: Machine was created; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Add a machine
      tags:
      - Machines
  /v1/machines/{id}:
    get:
      description: Retrieves the details of the machine that matches the specified  `id`.
      operationId: machines_getById
      parameters:
      - description: UUID of a Machine
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineInformation'
          description: Machine was found; details in the response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Machine not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Get a machine details
      tags:
      - Machines
    delete:
      description: Deletes a machine that has the specified `id`.
      operationId: machines_delete
      parameters:
      - description: UUID of a Machine.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine.
          format: uuid
          type: string
      responses:
        '204':
          description: Machine deleted.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Request conditions failed.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Certificate installation not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Request conditions failed.
      summary: Delete a machine
      tags:
      - Machines
    patch:
      description: Updates specific details of the machine that matches the specified `id`.
      operationId: machines_update
      parameters:
      - description: UUID of a Machine.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine.
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachineUpdateRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineInformation'
          description: Machine was updated; details in the response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Machine not found.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Update a machine details
      tags:
      - Machines
  /v1/machines/{id}/workflows:
    post:
      description: Triggers the beginning of the workflow.
      operationId: machines_initiateWorkflow
      parameters:
      - description: UUID of a Machine.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine.
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachineWorkflowRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineInformation'
          description: Workflow initiated successfully.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Request conditions failed.
      summary: Initiate the workflow
      tags:
      - Machines
  /v1/machinesearch:
    post:
      description: Retrieves the details of machines that match the specified [search expression](https://docs.venafi.cloud/CSH_api_search).
      operationId: getMachinesByExpression
      parameters:
      - description: Indicates whether response should include nested ownership data (e.g., `owningContainers`)
        in: query
        name: ownershipTree
        schema:
          default: false
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MachinesSearchRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineDocumentResponse'
          description: Details of Machines in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Get the details of machines matching
      tags:
      - Machines
  /v1/machines/{id}/batchprovisionings/abort:
    post:
      description: Triggers the abort operation on the current batch provisioning process for the machine with the specified `id`.
      operationId: abort-v1-batchprovisionings-forMachineId
      parameters:
      - description: UUID of a Machine.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine.
          format: uuid
          type: string
      responses:
        '202':
          description: Batch provisioning abort success.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Operation forbidden.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Active batch provisioning not found.
        '405':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Abort batch provisioning not allowed.
        '500':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Internal server error.
      summary: Abort active batch provisioning for a
      tags:
      - Machines
  /v1/machines/{id}/discovery:
    get:
      description: Retrieves the details of the machine's discovery.
      operationId: machineDiscoveryResults_getByMachineId
      parameters:
      - description: UUID of a Machine.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine.
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineDiscoveryResultInformation'
          description: Discovery result for machine was found; details in response body.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: The discovery result for the machine was not found. It is possible that discovery was never initiated. Run discovery and try again.
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Incomplete or malformed request.
      summary: Get the discovery results for a
      tags:
      - Machines
  /v1/machines/{id}/discovery/abort:
    post:
      description: Aborts an active discovery.
      operationId: machineDiscoveryResults_abortdiscovery
      parameters:
      - description: UUID of a Machine.
        in: path
        name: id
        required: true
        schema:
          description: UUID of a Machine.
          format: uuid
          type: string
      responses:
        '202':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MachineInformation'
          description: Abort discovery success.
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Operation forbidden.
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Active discovery not found.
        '405':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse3'
          description: Abort discovery not allowed.
      summary: Abort machine discovery
      tags:
      - Machines
components:
  schemas:
    ErrorInformation3:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue3'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    Expression:
      type: object
    MachineOwnership:
      properties:
        owningTeams:
          items:
            format: uuid
            type: string
          type: array
          uniqueItems: true
      type: object
    OrderObject:
      properties:
        direction:
          enum:
          - ASC
          - DESC
          type: string
        field:
          type: string
      type: object
    Ordering:
      properties:
        orders:
          items:
            $ref: '#/components/schemas/OrderObject'
          type: array
      type: object
    MachineDiscoveryResultInformation:
      properties:
        certificatesCountCurrent:
          format: int64
          type: integer
        certificatesCountTotal:
          format: int64
          type: integer
        companyId:
          format: uuid
          type: string
        discoveryStatus:
          enum:
          - NEVER INITIATED
          - INITIATED
          - RUNNING
          - COMPLETED
          - ABORTED
          - ABORTING
          - FAILED
          type: string
        endDate:
          format: date-time
          type: string
        errorCount:
          format: int32
          type: integer
        machineIdentitiesCount:
          format: int64
          type: integer
        machineIdentitiesDeletedCount:
          format: int64
          type: integer
        machineIdentitiesMissingCount:
          format: int64
          type: integer
        startDate:
          format: date-time
          type: string
      type: object
    ErrorResponse3:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation3'
          type: array
      type: object
    Paging:
      properties:
        pageNumber:
          format: int32
          type: integer
        pageSize:
          format: int32
          type: integer
      type: object
    MachineDocumentInformation:
      properties:
        companyId:
          format: uuid
          type: string
        creationDate:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        integrationId:
          format: uuid
          type: string
        machineIdentitiesCount:
          format: int32
          type: integer
        machineName:
          type: string
        machineType:
          deprecated: true
          type: string
        machineTypeId:
          deprecated: true
          format: uuid
          type: string
        modificationDate:
          format: date-time
          type: string
        ownership:
          $ref: '#/components/schemas/MachineOwnership'
        owningTeam:
          format: uuid
          type: string
        pluginId:
          format: uuid
          type: string
        pluginName:
          type: string
        status:
          enum:
          - DRAFT
          - VERIFIED
          - UNVERIFIED
          - DELETING
          type: string
        tsgId:
          type: string
      type: object
    MachineDocumentResponse:
      properties:
        machines:
          items:
            $ref: '#/components/schemas/MachineDocumentInformation'
          type: array
        totalCount:
          format: int64
          type: integer
      type: object
    MachineWorkflowRequest:
      properties:
        workflowInput:
          $ref: '#/components/schemas/AnyValue3'
        workflowName:
          type: string
      type: object
    MachineBatchProvisioningResultInformation:
      properties:
        endDate:
          format: date-time
          type: string
        errorMessage:
          type: string
        machineIdentitiesCount:
          format: int64
          type: integer
        machineIdentitiesFailedCount:
          format: int64
          type: integer
        machineIdentitiesSucceedCount:
          format: int64
          type: integer
        startDate:
          format: date-time
          type: string
        type:
          enum:
          - MANUAL
          - SCHEDULED
          type: string
      type: object
    MachinesSearchRequest:
      properties:
        expression:
          $ref: '#/components/schemas/Expression'
        ordering:
          $ref: '#/components/schemas/Ordering'
        paging:
          $ref: '#/components/schemas/Paging'
      type: object
    MachineCreationRequest:
      properties:
        connectionDetails:
          $ref: '#/components/schemas/AnyValue3'
        dekId:
          type: string
        edgeInstanceId:
          format: uuid
          type: string
        machineTypeId:
          deprecated: true
          format: uuid
          type: string
        name:
          minLength: 1
          type: string
        owningTeamId:
          format: uuid
          type: string
        pluginId:
          format: uuid
          type: string
        status:
          enum:
          - DRAFT
          - VERIFIED
          - UNVERIFIED
          - DELETING
          type: string
        tags:
          items:
            type: string
          type: array
      required:
      - connectionDetails
      - name
      - pluginId
      type: object
    SchedulerPatternInformation2:
      discriminator:
        propertyName: recurrenceType
      properties:
        recurrenceType:
          type: string
      required:
      - recurrenceType
      type: object
    MachinesResponse:
      properties:
        machines:
          items:
            $ref: '#/components/schemas/MachineInformation'
          type: array
      type: object
    MachineUpdateRequest:
      properties:
        batchProvisioningSchedulerEnabled:
          type: boolean
        batchProvisioningSchedulerPattern:
          $ref: '#/components/schemas/SchedulerPatternInformation2'
        connectionDetails:
          $ref: '#/components/schemas/AnyValue3'
        discoveryJson:
          $ref: '#/components/schemas/AnyValue3'
        discoverySchedulerEnabled:
          type: boolean
        discoverySchedulerPattern:
          $ref: '#/components/schemas/SchedulerPatternInformation2'
        edgeInstanceId:
          format: uuid
          type: string
        name:
          type: string
        owningTeamId:
          format: uuid
          type: string
        status:
          enum:
          - DRAFT
          - VERIFIED
          - UNVERIFIED
          - DELETING
          type: string
      type: object
    AnyValue3:
      description: Can be any value - string, number, boolean, array or object.
    MachineInformation:
      properties:
        batchProvisioningResult:
          $ref: '#/components/schemas/MachineBatchProvisioningResultInformation'
        batchProvisioningSchedulerEnabled:
          type: boolean
        batchProvisioningSchedulerPattern:
          $ref: '#/components/schemas/SchedulerPatternInformation2'
        batchProvisioningStatus:
          enum:
          - NEVER_INITIATED
          - INITIATED
          - RUNNING
          - COMPLETED
          - ABORTED
          - ABORTING
          - FAILED
          type: string
        companyId:
          format: uuid
          type: string
        creationDate:
          format: date-time
          type: string
        discoveryJson:
          $ref: '#/components/schemas/AnyValue3'
        discoverySchedulerEnabled:
          type: boolean
        discoverySchedulerPattern:
          $ref: '#/components/schemas/SchedulerPatternInformation2'
        discoveryStatus:
          enum:
          - NEVER INITIATED
          - INITIATED
          - RUNNING
          - COMPLETED
          - ABORTED
          - ABORTING
          - FAILED
          type: string
        edgeInstanceId:
          format: uuid
          type: string
        id:
          format: uuid
          type: string
        integrationId:
          format: uuid
          type: string
        machineType:
          deprecated: true
          type: string
        modificationDate:
          format: date-time
          type: string
        name:
          type: string
        owningTeamId:
          format: uuid
          type: string
        pluginId:
          format: uuid
          type: string
        status:
          enum:
          - DRAFT
          - VERIFIED
          - UNVERIFIED
          - DELETING
          type: string
        tsgId:
          type: string
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT