openapi: 3.2.0
info:
  title: TLS Protect Cloud API for Strata Cloud Manager V Satellite API
  description: Use the TLS Protect Cloud APIs to manage certificates, certificate requests, applications, machine identities, users, teams, event logs, and more. This Open API spec file was created on June 04, 2026. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
  license:
    name: MIT
    url: https://opensource.org/license/mit
servers:
- url: https://api.strata.paloaltonetworks.com/ngts
  description: Strata Cloud Manager API
security:
- scmToken: []
tags:
- name: VSatellite
  description: APIs for VSatellite.
paths:
  /v1/edgeinstances/{id}/update:
    post:
      description: Triggering an update for a satellite instance (manual)
      operationId: create-edgeinstances-update
      parameters:
      - description: Satellite Instance ID
        in: path
        name: id
        required: true
        schema:
          description: Satellite Instance ID
          format: uuid
          type: string
      responses:
        '202':
          description: Satellite Start Manual Update
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Satellite Instance Not Found
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
      summary: Trigger manual update of Satellite Instance
      tags:
      - VSatellite
  /v1/edgeencryptionkeys:
    get:
      description: Retrieve the list of satellite encryption keys based on query parameters
      operationId: edgeencryptionkeys_getAll
      parameters:
      - in: query
        name: edgeInstanceId
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EncryptionKeysResponse'
          description: List of SatelliteEncryption keys
      summary: Retrieve Satellite Encryption Keys
      tags:
      - VSatellite
  /v1/edgeencryptionkeys/{id}:
    get:
      description: Retrieve satellite encryption key with 'id' attribute matching specified value; specified value should be string not numeric
      operationId: edgeencryptionkeys_getById
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EncryptionKeyInformation'
          description: Encryption key information
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Encryption key not found
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
      summary: Retrieve SatelliteEncryption Key By Id
      tags:
      - VSatellite
  /v1/edgeinstances:
    get:
      description: Retrieve list of all satellite instances for company
      operationId: edgeinstances_getAll
      parameters:
      - in: query
        name: environmentId
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EdgeInstanceResponse'
          description: Satelliteinstances matching specified id
      summary: Retrieve Satellite Instances
      tags:
      - VSatellite
  /v1/edgeinstances/{id}:
    get:
      description: Retrieve satellite instance with 'id' attribute matching specified value; specified value should be uuid not numeric
      operationId: edgeinstances_getById
      parameters:
      - description: Satellite Instance ID
        in: path
        name: id
        required: true
        schema:
          description: Satellite Instance ID
          format: uuid
          type: string
      - in: query
        name: statusDetails
        schema:
          default: false
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EdgeInstanceInformation'
          description: Satellite instance matching specified id
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Satellite instance not found
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
      summary: Retrieve Satellite Instance By Id
      tags:
      - VSatellite
    put:
      description: Update satellite instance with specified new value
      operationId: edgeinstances_update
      parameters:
      - description: Satellite Instance ID
        in: path
        name: id
        required: true
        schema:
          description: Satellite Instance ID
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EdgeInstanceRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EdgeInstanceInformation'
          description: Satellite Instance Updated
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Satellite Instance Not Found
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
      summary: Update Satellite Instance
      tags:
      - VSatellite
  /v1/pairingcodes/satellite:
    post:
      description: Generate new pairing code for satellite instance registration
      operationId: pairingcodes_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PairingCodeRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PairingCodeInformation'
          description: Pairing Code Created
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
      summary: Create Pairing Code for Satellite Instance
      tags:
      - VSatellite
  /v1/recoverycodes/satellite:
    post:
      description: Generate new recovery code for satellite instance restoration
      operationId: recoverycodes_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RecoveryCodeRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecoveryCodeInformation'
          description: Recovery Code Created
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
      summary: Create Recovery Code for Satellite Instance
      tags:
      - VSatellite
  /v1/edgeworkers:
    get:
      description: Retrieve list of all satellite workers for company
      operationId: edgeworkers_getAll
      parameters:
      - in: query
        name: edgeInstanceId
        schema:
          format: uuid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EdgeWorkersResponse'
          description: List of Satellite workers
      summary: Retrieve Satellite Workers
      tags:
      - VSatellite
    post:
      description: Create satellite worker and generate the pairing information
      operationId: edgeworkers_create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EdgeWorkerRequest'
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EdgeWorkerInformation'
          description: Satellite worker information
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request conditions failed
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request conditions failed
      summary: Create Satellite Worker
      tags:
      - VSatellite
  /v1/edgeworkers/{id}/pair:
    post:
      operationId: edgeworkers_pair
      parameters:
      - description: EdgeWorker ID
        in: path
        name: id
        required: true
        schema:
          description: EdgeWorker ID
          format: uuid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/EdgeWorkerRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EdgeWorkerInformation'
          description: Satellite worker paired with Satellitehub
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request conditions failed
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request conditions failed
      summary: Pair Satellite Worker with Satellite Instance
      tags:
      - VSatellite
  /v1/edgeworkers/{id}:
    delete:
      description: Delete satellite worker
      operationId: edgeworker_delete
      parameters:
      - description: EdgeWorker ID
        in: path
        name: id
        required: true
        schema:
          description: EdgeWorker ID
          format: uuid
          type: string
      responses:
        '204':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EdgeWorkerDeleteResponse'
          description: Satellite worker deleted
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Satellite worker not found
        '412':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse6'
          description: Request Conditions Failed
      summary: Delete Satellite Worker
      tags:
      - VSatellite
  /v1/updatesconfig:
    get:
      description: Retrieve updates configuration for tenant
      operationId: updatesconfig_get
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdatesConfigResponse'
          description: Tenant updates configuration
      summary: Retrieve Updates configuration
      tags:
      - VSatellite
    patch:
      description: "Create or update updates configuration. The default update window is set to daily, with a start time at 12:00 AM and duration of 24 hours. This schedule allows updates to be performed on demand as soon as they become available.\n    **Example Default Request Body:**\n\n    ```json\n    {\n        \"updateConfigSchedulerPattern\": {\n            \"recurrenceType\": \"DAY\",\n            \"startTime\": \"00:00:00\",\n            \"duration\": \"PT24H\"\n        }\n    }\n    ```\n"
      operationId: updatesconfig_patch
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdatesConfigRequest'
        description: Modify updates configuration using patch behavior. All top level properties are optional
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdatesConfigResponse'
          description: Updates configuration created/updated
      summary: Create or Update Configuration
      tags:
      - VSatellite
components:
  schemas:
    WorkerStatus:
      enum:
      - DRAFT
      - PAIRED
      - ACTIVE
      - FAILED
      - INACTIVE
      type: string
    PairingCodeRequest:
      properties:
        environmentId:
          format: uuid
          type: string
        primaryInstanceId:
          format: uuid
          type: string
        reuseCount:
          format: int32
          type: integer
      type: object
    ProductEntitlement:
      enum:
      - ANY
      - MIRA
      - DEVOPS
      - OUTAGE_DETECTION
      - CODESIGN
      type: string
    AnyValue6:
      description: Can be any value - string, number, boolean, array or object.
    EdgeInstanceResponse:
      properties:
        edgeInstances:
          items:
            $ref: '#/components/schemas/EdgeInstanceInformation'
          type: array
      type: object
    WorkerServiceStatusDetails:
      properties:
        name:
          type: string
        status:
          type: string
      type: object
    ErrorInformation6:
      properties:
        args:
          items:
            $ref: '#/components/schemas/AnyValue6'
          type: array
        code:
          format: int32
          type: integer
        message:
          type: string
      type: object
    WeeklyPatternInformation:
      allOf:
      - $ref: '#/components/schemas/SchedulerPatternInformation3'
      - properties:
          daysOfWeek:
            description: Days of the week
            enum:
            - MONDAY
            - TUESDAY
            - WEDNESDAY
            - THURSDAY
            - FRIDAY
            - SATURDAY
            - SUNDAY
            items:
              description: Days of the week
              enum:
              - MONDAY
              - TUESDAY
              - WEDNESDAY
              - THURSDAY
              - FRIDAY
              - SATURDAY
              - SUNDAY
              type: string
            minItems: 1
            type: array
          duration:
            description: Duration in ISO-8601 format
            enum:
            - PT8H
            - PT12H
            - PT24H
            example: PT24H
            type: string
          startTime:
            description: Start time in HH:mm:ss format
            pattern: ^([01]\d|2[0-3]):[0-5]\d:[0-5]\d$
            type: string
        type: object
      required:
      - daysOfWeek
      - duration
      - startTime
      type: object
    EdgeInstanceRequest:
      properties:
        name:
          minLength: 1
          type: string
        upgradeOrderPriority:
          format: int32
          maximum: 100
          minimum: 1
          type: integer
      required:
      - name
      type: object
    EdgeType:
      enum:
      - ALL
      - HUB
      - SATELLITE
      type: string
    EdgeStatus:
      enum:
      - ACTIVE
      - LOST_CONNECTION
      - REGISTERED
      - PAIRED
      - LOST_CONNECTION_DURING_INSTALL
      - INSTALLED
      - INSTALL_FAILED
      - UNHEALTHY
      - ERROR
      - INSTALLING
      type: string
    PodStatusDetails:
      properties:
        age:
          format: int64
          type: integer
        cpuUsage:
          format: int32
          type: integer
        image:
          type: string
        memoryUsage:
          format: int64
          type: integer
        name:
          type: string
        restartCount:
          format: int32
          type: integer
        status:
          type: string
      type: object
    EdgeWorkerInformation:
      properties:
        companyId:
          format: uuid
          type: string
        edgeInstanceId:
          format: uuid
          type: string
        environmentId:
          format: uuid
          type: string
        hiddenPairingCode:
          type: string
        host:
          type: string
        id:
          format: uuid
          type: string
        lastSeenOnDate:
          format: date-time
          type: string
        pairingCode:
          type: string
        pairingPublicKey:
          type: string
        port:
          format: int32
          type: integer
        status:
          $ref: '#/components/schemas/WorkerStatus'
      type: object
    UpgradeStatus:
      enum:
      - LATEST
      - UPGRADE_PENDING
      - UPGRADING
      - FAILED
      type: string
    EdgeInstanceInformation:
      properties:
        address:
          type: string
        canRestore:
          type: boolean
        clientId:
          type: string
        companyId:
          format: uuid
          type: string
        deploymentDate:
          format: date-time
          type: string
        edgeStatus:
          $ref: '#/components/schemas/EdgeStatus'
        edgeType:
          $ref: '#/components/schemas/EdgeType'
        encryptionKeyDeploymentDate:
          format: date-time
          type: string
        encryptionKeyId:
          type: string
        environmentId:
          format: uuid
          type: string
        id:
          format: uuid
          type: string
        integrationServicesCount:
          format: int64
          type: integer
        kubernetesVersion:
          type: string
        lastSeenOnDate:
          format: date-time
          type: string
        modificationDate:
          format: date-time
          type: string
        name:
          type: string
        pairingCodeId:
          format: uuid
          type: string
        primaryInstanceId:
          format: uuid
          type: string
        productEntitlements:
          items:
            $ref: '#/components/schemas/ProductEntitlement'
          type: array
        reconciliationFailed:
          type: boolean
        satelliteVersion:
          type: string
        serviceAccountId:
          format: uuid
          type: string
        statusDetails:
          $ref: '#/components/schemas/EdgeInstanceStatusDetailsInformation'
        upgradeOrderPriority:
          format: int32
          type: integer
        upgradeStatus:
          $ref: '#/components/schemas/UpgradeStatus'
        version:
          format: int32
          type: integer
        workerStatusDetails:
          items:
            $ref: '#/components/schemas/EdgeWorkerStatusDetailsInformation'
          type: array
      type: object
    RecoveryCodeRequest:
      properties:
        edgeInstanceId:
          format: uuid
          type: string
      required:
      - edgeInstanceId
      type: object
    UpdatesConfigRequest:
      properties:
        updateConfigSchedulerPattern:
          oneOf:
          - $ref: '#/components/schemas/DailyPatternInformation'
          - $ref: '#/components/schemas/WeeklyPatternInformation'
          type: object
      required:
      - updateConfigSchedulerPattern
      type: object
    PairingCodeInformation:
      properties:
        companyId:
          format: uuid
          type: string
        environmentId:
          format: uuid
          type: string
        expirationDate:
          format: date-time
          type: string
        id:
          format: uuid
          type: string
        pairingCode:
          type: string
        productEntitlements:
          items:
            $ref: '#/components/schemas/ProductEntitlement'
          type: array
        reuseCount:
          format: int32
          type: integer
      type: object
    EdgeInstanceConnectionDetails:
      properties:
        activeMessageCount:
          format: int32
          type: integer
        companyId:
          format: uuid
          type: string
        edgeInstanceId:
          format: uuid
          type: string
        expiredMessageCount:
          format: int32
          type: integer
        failedMessageCount:
          format: int32
          type: integer
        lastConnectedDate:
          format: date-time
          type: string
        lastDisconnectedDate:
          format: date-time
          type: string
        timestamp:
          format: date-time
          type: string
      type: object
    EdgeInstanceStatusDetailsInformation:
      properties:
        connectionDetails:
          items:
            $ref: '#/components/schemas/EdgeInstanceConnectionDetails'
          type: array
        healthDetails:
          items:
            $ref: '#/components/schemas/EdgeInstanceHealthDetails'
          type: array
      type: object
    EdgeWorkerRequest:
      properties:
        edgeInstanceId:
          format: uuid
          type: string
        host:
          type: string
        port:
          format: int32
          type: integer
      type: object
    NamespaceStatusDetails:
      properties:
        name:
          type: string
        pods:
          items:
            $ref: '#/components/schemas/PodStatusDetails'
          type: array
        timestamp:
          format: date-time
          type: string
      type: object
    HSMEdgeStatus:
      enum:
      - HSM_ERROR
      - HSM_NOT_CONFIGURED
      - HSM_LOST_CONNECTION
      - HSM_HEALTHY
      type: string
    EncryptionKeysResponse:
      properties:
        encryptionKeys:
          items:
            $ref: '#/components/schemas/EncryptionKeyInformation'
          type: array
      type: object
    EdgeWorkerStatusDetailsInformation:
      properties:
        edgeWorkerId:
          format: uuid
          type: string
        healthDetails:
          items:
            $ref: '#/components/schemas/EdgeWorkerHealthDetails'
          type: array
      type: object
    EncryptionKeyInformation:
      properties:
        companyId:
          format: uuid
          type: string
        id:
          type: string
        key:
          type: string
        keyAlgorithm:
          $ref: '#/components/schemas/KeyAlgorithm'
        lastBackupDate:
          format: date-time
          type: string
      type: object
    DailyPatternInformation:
      allOf:
      - $ref: '#/components/schemas/SchedulerPatternInformation3'
      - properties:
          duration:
            description: Duration in ISO-8601 format
            enum:
            - PT8H
            - PT12H
            - PT24H
            example: PT24H
            type: string
          startTime:
            description: Start time in HH:mm:ss format
            pattern: ^([01]\d|2[0-3]):[0-5]\d:[0-5]\d$
            type: string
        type: object
      required:
      - duration
      - startTime
      type: object
    EdgeWorkerDeleteResponse:
      properties:
        id:
          format: uuid
          type: string
        pairingCode:
          type: string
      type: object
    RecoveryCodeInformation:
      properties:
        companyId:
          format: uuid
          type: string
        dataPlaneDomain:
          type: string
        expirationDate:
          format: date-time
          type: string
        hiddenRecoveryCode:
          type: string
        id:
          format: uuid
          type: string
        productEntitlements:
          items:
            $ref: '#/components/schemas/ProductEntitlement'
          type: array
        recoveryCode:
          type: string
        tsgId:
          type: string
      type: object
    NodeInfo:
      properties:
        kubelet_version:
          type: string
      type: object
    UpdatesConfigResponse:
      properties:
        updateConfigSchedulerPattern:
          oneOf:
          - $ref: '#/components/schemas/DailyPatternInformation'
          - $ref: '#/components/schemas/WeeklyPatternInformation'
          type: object
      type: object
    EdgeInstanceHealthDetails:
      properties:
        companyId:
          format: uuid
          type: string
        edgeInstanceId:
          format: uuid
          type: string
        hsmStatus:
          $ref: '#/components/schemas/HSMEdgeStatus'
        installedCharts:
          items:
            $ref: '#/components/schemas/NamespaceChartDetails'
          type: array
        nodeStatus:
          items:
            $ref: '#/components/schemas/NodeStatusDetails'
          type: array
        systemstatus:
          items:
            $ref: '#/components/schemas/NamespaceStatusDetails'
          type: array
        timestamp:
          format: date-time
          type: string
        version:
          type: string
      type: object
    ChartDetails:
      properties:
        name:
          type: string
        version:
          type: string
      type: object
    KeyAlgorithm:
      enum:
      - RSA
      - ED25519
      - VSAT_HPKE
      type: string
    NamespaceChartDetails:
      properties:
        charts:
          items:
            $ref: '#/components/schemas/ChartDetails'
          type: array
        name:
          type: string
      type: object
    NodeCondition:
      properties:
        Status:
          type: string
          writeOnly: true
        Type:
          type: string
          writeOnly: true
        status:
          type: string
        type:
          type: string
      type: object
    EdgeWorkersResponse:
      properties:
        edgeWorkers:
          items:
            $ref: '#/components/schemas/EdgeWorkerInformation'
          type: array
      type: object
    ErrorResponse6:
      properties:
        errors:
          items:
            $ref: '#/components/schemas/ErrorInformation6'
          type: array
      type: object
    SchedulerPatternInformation3:
      discriminator:
        mapping:
          DAY: '#/components/schemas/DailyPatternInformation'
          WEEK: '#/components/schemas/WeeklyPatternInformation'
        propertyName: recurrenceType
      properties:
        recurrenceType:
          type: string
      required:
      - recurrenceType
      type: object
    EdgeWorkerHealthDetails:
      properties:
        age:
          format: int64
          type: integer
        companyId:
          format: uuid
          type: string
        cpuUsage:
          format: int32
          type: integer
        edgeInstanceId:
          format: uuid
          type: string
        edgeWorkerId:
          format: uuid
          type: string
        host:
          type: string
        memoryUsage:
          format: int64
          type: integer
        port:
          format: int32
          type: integer
        services:
          items:
            $ref: '#/components/schemas/WorkerServiceStatusDetails'
          type: array
        status:
          type: string
        timestamp:
          format: date-time
          type: string
      type: object
    NodeStatusDetails:
      properties:
        conditions:
          items:
            $ref: '#/components/schemas/NodeCondition'
          type: array
        info:
          $ref: '#/components/schemas/NodeInfo'
      type: object
  securitySchemes:
    scmOAuth:
      type: oauth2
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      flows:
        clientCredentials:
          tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
          scopes: {}
    scmToken:
      type: http
      description: 'Strata Cloud Manager APIs authenticate client requests using the OAuth 2.0 Client Credentials flow. Please use the `client_id`, `client_secret` values associated with an IAM service account along with a scope value of `tsg_id:XXXXXXXXXX`, where `XXXXXXXXXX` is the Tenant Service Group (TSG) ID. The resulting JWT access token should be attached to all API calls as a `Bearer` token in the `Authorization` header (ex. `Authorization: Bearer tokenstring`).'
      scheme: bearer
      bearerFormat: JWT