generated: '2026-07-11'
method: searched
docs: https://pan.dev/sase/docs/scope/
source: openapi/palo-alto-autonomous-dem-api-openapi-original.yml, openapi/palo-alto-prisma-access-api-openapi-original.yml,
  openapi/palo-alto-prisma-sd-wan-api-openapi-original.yml
schemes:
- name: oauth2
  source: openapi/palo-alto-autonomous-dem-api-openapi-original.yml
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
  description: OAuth 2.0 client credentials flow for obtaining an access token. Requires a client
    ID and client secret from the Palo Alto Networks SASE identity provider.
- name: oauth2
  source: openapi/palo-alto-prisma-access-api-openapi-original.yml
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
  description: OAuth 2.0 client credentials flow for obtaining an access token. Requires a client
    ID and client secret from the Palo Alto Networks SASE identity provider.
- name: oauth2
  source: openapi/palo-alto-prisma-sd-wan-api-openapi-original.yml
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.apps.paloaltonetworks.com/oauth2/access_token
  description: OAuth 2.0 client credentials flow for obtaining an access token. Requires a client
    ID and client secret from the Palo Alto Networks SASE identity provider.
scopes:
- scope: tsg_id:<TSG_ID>
  description: Scopes the access token to a single Tenant Service Group (TSG), identified by its
    10-digit TSG ID (e.g. scope=tsg_id:1838006364). The service account used to authenticate must
    belong to the named TSG or an ancestor of it; all API requests made with the token are routed
    to that tenant. This is the only scope form the Prisma SASE Authentication Service documents.
  sources:
  - https://pan.dev/sase/docs/scope/
  - https://pan.dev/sase/docs/access-tokens/
note: Prisma SASE OAuth 2.0 (client_credentials) uses the scope field solely to name the target
  Tenant Service Group (tsg_id:<TSG_ID>); there is no catalog of named permission scopes, and API
  permissions are instead governed by IAM roles assigned to the service account
  (https://pan.dev/sase/docs/scope/).