Prisma Sase Claw

Prisma SASE API Integration

This skill generates working curl commands and Python scripts to interact with the Palo Alto Networks Prisma SASE platform API. It covers three main products:

• Prisma Access — Cloud-delivered network security (security policies, remote networks, GlobalProtect, service connections)
• Prisma SD-WAN — Software-defined WAN (site configs, routing, path policies, performance monitoring)
• Prisma Access Browser — Secure enterprise browser management

Quick Reference

Authentication

All API calls use OAuth2 client credentials flow. The user needs three values:

• client_id and client_secret — from a service account created in the Prisma SASE UI
• tsg_id — the Tenant Service Group ID scoping the token

Get an access token

curl -s -X POST "https://auth.apps.paloaltonetworks.com/oauth2/access_token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "${CLIENT_ID}:${CLIENT_SECRET}" \
  -d "grant_type=client_credentials&scope=tsg_id:${TSG_ID}"

The response returns a JWT access token valid for 15 minutes. There is no refresh token — request a new one when it expires.

Python authentication helper

When generating Python scripts, use the helper at scripts/sase_auth.py (relative to this skill directory). Read it for the implementation — it handles token caching and auto-renewal.

Required headers for all API calls

Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json

Some services also require a regional header:

x-panw-region: <region_code>

Required for: Aggregate Monitoring, ZTNA Connector, Autonomous DEM. Valid regions: americas, au, ca, de, europe, in, jp, sg, uk.

Important: Including x-panw-region on services that don't need it causes errors. Only add it when the endpoint requires it.

Product-Specific Guides

Depending on what the user needs, read the relevant reference file for detailed endpoint documentation:

Read the appropriate reference file before generating API calls for that product area.

Common API Patterns

Prisma Access Configuration: Candidate/Running Config Model

Prisma Access uses a two-stage configuration model. Changes go to a "candidate" config first, then must be pushed to become the "running" config:

1. Make changes — POST/PUT/DELETE to config endpoints (creates candidate changes)
2. Push candidate config:

   curl -s -X POST "https://api.sase.paloaltonetworks.com/sse/config/v1/config-versions/candidate:push" \
     -H "Authorization: Bearer ${TOKEN}" \
     -H "Content-Type: application/json" \
     -d '{"folders": ["All"]}'
   

3. Monitor the push job until it completes
4. The candidate becomes the running configuration

Always remind the user that config changes won't take effect until pushed.

SD-WAN: Profile Initialization

After obtaining a token, the first SD-WAN API call must be:

curl -s -X GET "https://api.sase.paloaltonetworks.com/sdwan/v2.1/api/profile" \
  -H "Authorization: Bearer ${TOKEN}"

Skipping this causes 403 errors on subsequent SD-WAN calls.

Aggregate Monitoring: POST-based Filtering

Monitoring queries use POST with structured filter bodies, not query parameters:

{
  "filter": {
    "operator": "AND",
    "rules": [
      {"property": "severity", "operator": "in", "values": ["Critical", "High"]},
      {"property": "event_time", "operator": "last_n_days", "values": [7]}
    ]
  },
  "properties": [
    {"property": "total_count"},
    {"property": "severity"}
  ]
}

Filter operators: in, gt, lt, last_n_minutes, last_n_hours, last_n_days.

Multi-tenant Aggregation

Add ?agg_by=tenant to aggregate responses across a parent tenant and all child tenants.

Common Error Codes

Script Generation Guidelines

When generating scripts for the user:

1. Always parameterize credentials — never hardcode client_id, client_secret, or tsg_id. Use environment variables or prompt the user.
2. Handle token expiry — tokens last 15 minutes. For long-running scripts, implement token refresh logic.
3. Include error handling — check HTTP status codes and print meaningful error messages.
4. Use the auth helper — for Python scripts, reference scripts/sase_auth.py for a reusable auth class.
5. Remind about config push — when generating Prisma Access config changes, always include the push step or remind the user it's needed.
6. Initialize SD-WAN profile — when generating SD-WAN scripts, include the profile initialization call.

Tenant Service Groups (TSGs)

TSGs are the organizational hierarchy for multi-tenancy:

• A TSG contains tenants and/or child TSGs
• OAuth tokens are scoped to a specific TSG and its children
• The root TSG must be created via UI; child TSGs can be created via API
• Key endpoints:
  • GET /tenancy/v1/tenant_service_groups — list all TSGs
  • TSG children and ancestors are also queryable

IAM and Roles

Service accounts need appropriate roles assigned to perform API operations. Key roles:

• Superuser — full read/write
• Security Admin — security policy management
• Network Admin — network policy and logs
• View Only Administrator — read-only across all
• SOC Analyst — read-only for logs, reports, alerts

If the user gets 403 errors, suggest checking their service account's role assignments.