openapi: 3.2.0
info:
  contact:
    email: support@paloaltonetworks.com
  description: 'The Open API specification file represents the APIs available for Prisma Access Insights 3.0.

    The Prisma Access Insights 3.0 APIs allow you to query your Prisma Access tenant for the health of

    your Prisma Access network deployment. The 3.0 APIs are intended for cloud-managed Prisma Access

    customers, where the tenants have been onboarded by Palo Alto Networks using a Tenant Service Group

    (TSG) identifier.


    These APIs use the common SASE authentication mechanism and base URL. See the

    [Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information.


    This Open API spec file was created on May 30, 2025. To check for a more recent version of this file, see

    [Prisma Insights APIs on pan.dev](https://pan.dev//access/api/insights/).


    © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo

    Alto Networks. A list of our trademarks can be found at


    [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html)


    All other marks mentioned herein may be trademarks of their respective companies.

    '
  license:
    name: MIT
    url: https://opensource.org/license/mit
  termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf
  title: Palo Alto Networks 3.0 Users API API
  version: '3.0'
servers:
- url: https://api.sase.paloaltonetworks.com
tags:
- description: 'Users API

    '
  name: Users API
paths:
  /insights/v3.0/resource/query/users/agent/connected_user_count:
    post:
      description: 'Retrieve the number of connected agent users.

        '
      operationId: post-insights-v3.0-resource-query-users-agent-connected_user_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: connect_method
                      values:
                      - AGENT
                      - AGENT_PROXY
                    - operator: in
                      property: application_name
                      values:
                      - salesforce
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: fw_name
                      values:
                      - vmseries
                    - operator: in
                      property: source_country_name
                      values:
                      - US
                    - operator: in
                      property: source_city_name
                      values:
                      - San Jose
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: domain_name
                      values:
                      - salesforce.com
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Name of the application.
                            example: salesforce
                            type: string
                          connect_method:
                            description: Method of connection.
                            example: AGENT
                            type: string
                          domain_name:
                            description: Application domain name.
                            example: salesforce.com
                            type: string
                          edge_location_display_name:
                            description: Name of the PA location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          fw_name:
                            description: Name of the firewall.
                            example: vmseries
                            type: string
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          source_city_name:
                            description: Name of the source city.
                            example: San Jose
                            type: string
                          source_country_name:
                            description: Name of the source country.
                            example: US
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Count of connected users.
                    example: 18669
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Agent Connected Users Data
      tags:
      - Users API
  /insights/v3.0/resource/query/users/agentless/connected_user_count:
    post:
      description: 'Retrieve the number of connected agentless proxy users.

        '
      operationId: post-insights-v3.0-resource-query-users-agentless-connected_user_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: connection_method
                      values:
                      - AGENTLESS
                    - operator: in
                      property: application_name
                      values:
                      - salesforce
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: fw_name
                      values:
                      - vmseries
                    - operator: in
                      property: source_country_name
                      values:
                      - US
                    - operator: in
                      property: source_city_name
                      values:
                      - San Jose
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: domain_name
                      values:
                      - salesforce.com
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Application name.
                            example: zoom
                            type: string
                          connection_method:
                            description: Connection method used by the user.
                            example: AGENTLESS
                            type: string
                          device_score:
                            description: Device score.
                            example: 3
                            type: number
                          edge_location_display_name:
                            description: Prisma Access Location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: User experience score.
                            example: 4
                            type: number
                          geoip_from_city_name:
                            description: City from GeoIP.
                            example: San Jose
                            type: string
                          geoip_from_country_name:
                            description: Country from GeoIP.
                            example: US
                            type: string
                          instance_name:
                            description: Instance name.
                            example: instance1
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 3
                            type: number
                          lan_score:
                            description: LAN score.
                            example: 5
                            type: number
                          pa_score:
                            description: Prisma Access score.
                            example: 5
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          source_user_info_name:
                            description: Source user name.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: Wifi score.
                            example: 4
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Count of connected users.
                    example: 15669
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Agentless Connected User Data
      tags:
      - Users API
  /insights/v3.0/resource/query/users/all/user_list_all:
    post:
      description: Retrieves a list of users with detailed information.
      operationId: post-insights-v3.0-resource-query-users-all-user_list_all
      parameters:
      - description: Region mapping for the tenant.
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation.
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: connection_method
                      values:
                      - Agent
                    - operator: gt
                      property: experience_score
                      values:
                      - 70
                    - operator: gt
                      property: device_score
                      values:
                      - 80
                    - operator: gt
                      property: lan_score
                      values:
                      - 90
                    - operator: gt
                      property: wifi_score
                      values:
                      - 85
                    - operator: gt
                      property: pa_score
                      values:
                      - 75
                    - operator: gt
                      property: internet_score
                      values:
                      - 95
                    - operator: in
                      property: pa_location_name
                      values:
                      - US West
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US East
                    - operator: in
                      property: instance_name
                      values:
                      - PA-VM
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: application_name
                      values:
                      - Salesforce
                    - operator: in
                      property: rbi
                      values:
                      - Enabled
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: domain_name
                      values:
                      - salesforce.com
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Application.
                            example: Salesforce
                            type: string
                          connection_method:
                            description: Device connection method.
                            example: Agent
                            type: string
                          device_score:
                            description: Device score.
                            example: 80
                            type: number
                          domain_name:
                            description: Application domain name.
                            example: salesforce.com
                            type: string
                          edge_location_display_name:
                            description: Edge location display name.
                            example: US East
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: Experience score.
                            example: 70
                            type: number
                          instance_name:
                            description: Firewall name.
                            example: PA-VM
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 95
                            type: number
                          lan_score:
                            description: LAN score.
                            example: 90
                            type: number
                          pa_score:
                            description: Prisma Access score.
                            example: 75
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          rbi:
                            description: RBI status.
                            example: Enabled
                            type: string
                          source_city_name:
                            description: Source city name.
                            example: San Jose
                            type: string
                          source_country_name:
                            description: Source country name.
                            example: US
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: WiFi score.
                            example: 85
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  adem_username:
                    description: ADEM Username.
                    example: john.doe@example.com
                    type: string
                  agent_uuid:
                    description: Agent UUID.
                    example: a1b2c3d4-e5f6-7890-1234-567890abcdef
                    type: string
                  application_count:
                    description: Application count.
                    example: 10
                    type: integer
                  connection_method:
                    description: Connection method.
                    example: Agent
                    type: string
                  device_name:
                    description: Device name.
                    example: Device - 10.01.00.00
                    type: string
                  device_score_value:
                    description: Device score value.
                    example: 80
                    type: integer
                  experience_score_value:
                    description: Experience score value.
                    example: 70
                    type: integer
                  internet_score_value:
                    description: Internet score value.
                    example: 95
                    type: integer
                  lan_score_value:
                    description: LAN score value.
                    example: 90
                    type: integer
                  last_activity_timestamp_epoc_millis:
                    description: Last activity timestamp in epoch milliseconds.
                    example: 1678886400000
                    type: integer
                  pa_fw_location:
                    description: Prisma Access firewall location.
                    example: sfc-cor-cf000
                    type: string
                  pa_score_value:
                    description: Prisma Access score value.
                    example: 75
                    type: integer
                  source_city:
                    description: Source city.
                    example: San Jose
                    type: string
                  source_country:
                    description: Source country.
                    example: US
                    type: string
                  threat_count:
                    description: Threat count.
                    example: 5
                    type: integer
                  total_bytes:
                    description: Total bytes transferred.
                    example: 1000000
                    type: integer
                  username:
                    description: Username.
                    example: john.doe
                    type: string
                  wifi_score_value:
                    description: WiFi score value.
                    example: 85
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Get User List
      tags:
      - Users API
  /insights/v3.0/resource/query/users/branch/connected_user_count:
    post:
      description: 'Retrieve the number of branch connected users.

        '
      operationId: post-insights-v3.0-resource-query-users-branch-connected_user_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: connection_method
                      values:
                      - BRANCH
                    - operator: gt
                      property: experience_score
                      values:
                      - 70
                    - operator: gt
                      property: device_score
                      values:
                      - 80
                    - operator: gt
                      property: lan_score
                      values:
                      - 60
                    - operator: gt
                      property: wifi_score
                      values:
                      - 70
                    - operator: gt
                      property: pa_score
                      values:
                      - 80
                    - operator: gt
                      property: internet_score
                      values:
                      - 50
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: instance_name
                      values:
                      - fw00
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: domain_name
                      values:
                      - salesforce.com
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          connection_method:
                            description: Method of connection.
                            example: BRANCH
                            type: string
                          device_score:
                            description: Device score.
                            example: 90
                            type: number
                          domain_name:
                            description: Application domain name.
                            example: salesforce.com
                            type: string
                          edge_location_display_name:
                            description: Name of the PA location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: Experience score.
                            example: 80
                            type: number
                          instance_name:
                            description: Name of the firewall.
                            example: fw00
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 70
                            type: number
                          lan_score:
                            description: LAN score.
                            example: 75
                            type: number
                          pa_score:
                            description: Prisma Access score.
                            example: 95
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          source_city:
                            description: Name of the source city.
                            example: San Jose
                            type: string
                          source_country:
                            description: Name of the source country.
                            example: US
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: WiFi score.
                            example: 85
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Count of users.
                    example: 19399
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Branch Connected Users Data
      tags:
      - Users API
  /insights/v3.0/resource/query/users/eb/connected_user_count:
    post:
      description: 'Retrieve the number of users connected through Enterprise Browser.

        '
      operationId: post-insights-v3.0-resource-query-users-eb-connected_user_count
      parameters:
      - description: 'Map the region for the tenant.

          '
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures.

          '
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: connection_method
                      values:
                      - PAB
                    - operator: in
                      property: application_name
                      values:
                      - salesforce
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: instance_name
                      values:
                      - fw00
                    - operator: in
                      property: source_country
                      values:
                      - US
                    - operator: in
                      property: source_city
                      values:
                      - San Jose
                    - operator: in
                      property: username
                      values:
                      - john.doe
                    - operator: in
                      property: domain_name
                      values:
                      - salesforce.com
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Name of the application.
                            example: salesforce
                            type: string
                          connection_method:
                            description: Method of connection.
                            example: PAB
                            type: string
                          domain_name:
                            description: Application domain name.
                            example: salesforce.com
                            type: string
                          edge_location_display_name:
                            description: Name of the PA location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          instance_name:
                            description: Name of the firewall.
                            example: fw00
                            type: string
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          source_city:
                            description: Name of the source city.
                            example: San Jose
                            type: string
                          source_country:
                            description: Name of the source country.
                            example: US
                            type: string
                          username:
                            description: Username.
                            example: john.doe
                            type: string
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Count of users.
                    example: 19399
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Enterprise Browser Connected Users Data
      tags:
      - Users API
  /insights/v3.0/resource/query/users/other/connected_entity_count:
    post:
      description: Retrieves the count of connected user count for other hosts.
      operationId: post-insights-v3.0-resource-query-users-other-connected_entity_count
      parameters:
      - description: Region mapping for the tenant.
        in: header
        name: X-PANW-Region
        required: true
        schema:
          example: americas
          type: string
      - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation.
        in: header
        name: Prisma-Tenant
        required: false
        schema:
          example: 12345678:12345679
          type: string
      requestBody:
        content:
          application/json:
            examples:
              With mandatory filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
              With possible filters:
                value:
                  filter:
                    rules:
                    - operator: last_n_hours
                      property: event_time
                      values:
                      - 5
                    - operator: in
                      property: platform_type
                      values:
                      - prisma_access
                      - ngfw
                    - operator: in
                      property: connection_method
                      values:
                      - OTHER
                    - operator: in
                      property: application_name
                      values:
                      - zoom
                    - operator: in
                      property: experience_score
                      values:
                      - 100
                    - operator: in
                      property: device_score
                      values:
                      - 70
                    - operator: in
                      property: lan_score
                      values:
                      - 10
                    - operator: in
                      property: wifi_score
                      values:
                      - 10
                    - operator: in
                      property: pa_score
                      values:
                      - 10
                    - operator: in
                      property: internet_score
                      values:
                      - 30
                    - operator: in
                      property: rbi
                      values:
                      - enabled
                    - operator: in
                      property: edge_location_display_name
                      values:
                      - US West
                    - operator: in
                      property: instance_name
                      values:
                      - fw_000
            schema:
              properties:
                filter:
                  properties:
                    rules:
                      items:
                        properties:
                          application_name:
                            description: Application name.
                            example: zoom
                            type: string
                          connection_method:
                            description: Connection method.
                            example: OTHER
                            type: string
                          device_score:
                            description: Device score.
                            example: 3
                            type: number
                          edge_location_display_name:
                            description: Prisma Access Location.
                            example: US West
                            type: string
                          event_time:
                            description: Time of the event.
                            example: 5
                            type: number
                          experience_score:
                            description: User experience score.
                            example: 4
                            type: number
                          geoip_from_city_name:
                            description: City from GeoIP.
                            example: San Jose
                            type: string
                          geoip_from_country_name:
                            description: Country from GeoIP.
                            example: US
                            type: string
                          instance_name:
                            description: Instance name.
                            example: instance1
                            type: string
                          internet_score:
                            description: Internet score.
                            example: 3
                            type: number
                          lan_score:
                            description: LAN score.
                            example: 5
                            type: number
                          pa_score:
                            description: Prisma Access score.
                            example: 5
                            type: number
                          platform_type:
                            description: Type of platform.
                            example: prisma_access
                            type: string
                          rbi:
                            description: Remote Browser Isolation status.
                            example: enabled
                            type: string
                          source_user_info_name:
                            description: Source user name.
                            example: john.doe
                            type: string
                          wifi_score:
                            description: Wifi score.
                            example: 4
                            type: number
                        type: object
                      required:
                      - event_time
                      type: array
                  type: object
              type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  user_count:
                    description: Count of connected entities.
                    example: 15700
                    type: integer
                type: object
          description: OK
        '400':
          description: Resource property is not valid
        '403':
          description: Permission Denied
        '404':
          description: Resource not found
        '500':
          description: Failed to process request
      security:
      - Bearer: []
      summary: Connected User Count For Other Hosts
      tags:
      - Users API
components:
  securitySchemes:
    Bearer:
      scheme: bearer
      type: http