Application catalog

The application catalog is the Universal Application Directory (UAD): a curated library of SaaS and web applications maintained by Palo Alto Networks. Catalog applications have type: catalog and are updated regularly as services add domains, change URLs, or earn new certifications. You can list, read, and reference catalog applications in rules, and set their classification and tags for your tenant. You cannot create or delete them or change any other field.

For curated desktop applications, see the localdesktopcatalog type on Desktop applications.

On this page: what you can and cannot do, list and filter, get one, set classification and tags, key fields, endpoint reference, tips.

---

What you can and cannot do

Operation	Supported?	Notes
List catalog apps	Yes	GET /applications with type=catalog
Read one catalog app	Yes	GET /applications/{id}
Reference in a rule	Yes	By ID, directly or via an application group
Read classification and tags	Yes	Returned like any other application. See Tags and classification
Set classification and tagIDs	Yes	PATCH /applications/type/catalog/{id}, or bulk update for up to 500 applications. See Set classification and tags
Create / delete, or change any other field	No	Catalog apps are managed by Palo Alto Networks
Draft and publish	For classification and tags	Changes to classification and tagIDs are made in the draft. Publish to make them live

---

List and filter

Filter the full applications list to type=catalog. Supports name search, pagination (limit / cursor), and sort / order.

GET /seb-api/v1/applications

curl -sS -G "$PB_API_BASE/applications" \
  -H "Authorization: Bearer $PB_TOKEN" \
  --data-urlencode "type=catalog" \
  --data-urlencode "name=figma" \
  --data-urlencode "limit=50"

Response (200):

{
  "data": [
    {
      "type": "catalog",
      "id": "0AP01FIGMAXXXXXXXXXXXXXXXXXXX",
      "name": "Figma",
      "description": "Collaborative interface design tool.",
      "category": "Design",
      "classification": "Sanctioned",
      "tags": [ { "id": "0TG01F1NANCEAPPR0VEDXXXXXXXXX", "name": "Finance approved" } ],
      "metadata": { "createdTime": "2024-04-26T12:48:39Z", "lastUpdatedTime": "2026-01-15T10:00:00Z" },
      "urls": [ "*://www.figma.com/*", "*://figma.com/*" ],
      "catalog_name": "figma"
    }
    // ... more catalog applications
  ],
  "metadata": { "configurationVersion": { "id": "0CV01EXAMPLEXXXXXXXXXXXXXXXXX", "status": "draft", "number": 0 } },
  "pageInfo": { "hasNextPage": true, "cursor": "gaFpvTBBUDAx...", "totalCount": 1 }
}

To include compliance and security metadata in the response, add includeCatalogAttributes=true:

curl -sS -G "$PB_API_BASE/applications" \
  -H "Authorization: Bearer $PB_TOKEN" \
  --data-urlencode "type=catalog" \
  --data-urlencode "name=figma" \
  --data-urlencode "includeCatalogAttributes=true"

Response (200). Each item gains a catalog_attributes object; unknown values are null:

{
  "data": [
    {
      "type": "catalog",
      "id": "0AP01FIGMAXXXXXXXXXXXXXXXXXXX",
      "name": "Figma",
      "category": "Design",
      "classification": "Sanctioned",
      "tags": [ { "id": "0TG01F1NANCEAPPR0VEDXXXXXXXXX", "name": "Finance approved" } ],
      "urls": [ "*://figma.com/*" ],
      "catalog_name": "figma",
      "catalog_attributes": {
        "encryption_in_transit": true,
        "encryption_at_rest": true,
        "soc2": true,
        "iso_27001": true,
        "gdpr": true,
        "hipaa": null
        // ... many more compliance attributes, null when unknown
      }
    }
    // ... more catalog applications
  ],
  "pageInfo": { "hasNextPage": true, "cursor": "gaFpvTBBUDAx...", "totalCount": 1 }
}

---

Get one

GET /seb-api/v1/applications/{id}

curl -sS "$PB_API_BASE/applications/$APP_ID" \
  -H "Authorization: Bearer $PB_TOKEN"

Response (200):

{
  "type": "catalog",
  "id": "0AP01FIGMAXXXXXXXXXXXXXXXXXXX",
  "name": "Figma",
  "description": "Collaborative interface design tool.",
  "category": "Design",
  "classification": "Sanctioned",
  "tags": [ { "id": "0TG01F1NANCEAPPR0VEDXXXXXXXXX", "name": "Finance approved" } ],
  "metadata": { "createdTime": "2024-04-26T12:48:39Z", "lastUpdatedTime": "2026-01-15T10:00:00Z" },
  "urls": [ "*://figma.com/*" ],
  "catalog_name": "figma"
}

To include catalog attributes on a single-app read, append ?includeCatalogAttributes=true to the URL.

---

Set classification and tags

classification and tagIDs are the only fields you can change on a catalog application. Send type: catalog with one or both:

PATCH /seb-api/v1/applications/type/catalog/{id}

curl -sS -X PATCH "$PB_API_BASE/applications/type/catalog/$APP_ID" \
  -H "Authorization: Bearer $PB_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
        "type": "catalog",
        "classification": "Sanctioned",
        "tagIDs": { "add": [ "0TG01FINANCEAPPROVEDXXXXXXXXX" ] }
      }'

Response (200):

{ "id": "0AP01FIGMAXXXXXXXXXXXXXXXXXXX" }

tagIDs takes a plain array to replace the set, or { "add": [...], "remove": [...] } to adjust it. The values are scoped to your tenant: the catalog entry itself does not change for anyone else. To classify or tag many applications at once, use bulk update.

---

Key fields

Field	Type	Notes
id	string	Prefixed with 0AP...
type	string	Always catalog for these objects
name	string	Display name as it appears in the directory
catalog_name	string	Canonical catalog identifier (may differ from name)
urls	array	The URL patterns that identify this application. Maintained by Palo Alto Networks
classification	string	Settable with PATCH. See Tags and classification
tags	array	Objects of { id, name }. Set with tagIDs on PATCH

catalog_attributes

Returned when includeCatalogAttributes=true is set. Contains security and compliance metadata for the application:

Attribute	Type	What it indicates
encryption_in_transit	boolean	Data is encrypted in transit
encryption_at_rest	boolean	Data is encrypted at rest
data_retention	string	Data retention policy or period
soc1	boolean	SOC 1 certified
soc2	boolean	SOC 2 certified
iso_27001	boolean	ISO 27001 certified
gdpr	boolean	GDPR compliant
hipaa	boolean	HIPAA compliant
pci	boolean	PCI DSS compliant
finra	boolean	FINRA compliant

Not every application has values for every attribute. A missing or null value means the information is not available in the catalog for that app.

---

Endpoint reference

Method	Path	Purpose
GET	/applications	List applications; filter by type=catalog
GET	/applications/{id}	Read one catalog application
PATCH	/applications/type/catalog/{id}	Set classification and tagIDs
POST	/applications/tags/bulk-update	Set tags and classification on up to 500 applications (preview)

All paths are under the /seb-api/v1 base.

---

Tips and gotchas

note

Check the catalog before creating a SaaS application. If the application already exists in the catalog, reference the catalog entry instead of recreating it as custom. You inherit its maintained URL list and compliance metadata, and Palo Alto Networks keeps it up to date. Only create a custom application when the catalog has no match.

note

Catalog apps are maintained and updated regularly. You do not need to manage their URLs. When a SaaS application adds or changes domains, the catalog entry is updated automatically. This is the main advantage of referencing a catalog app over a custom app for well-known services.

note

Request ?includeCatalogAttributes=true only when you need it. The compliance metadata is not included by default to keep response payloads small. Add the parameter when you are auditing or building a catalog browser.

note

Classification and tags are yours; everything else is not. A catalog application returns classification and tags like any other application, and those values are scoped to your tenant. Set them with PATCH or bulk update. The name, URLs, and catalog attributes are maintained by Palo Alto Networks.

---

Related

• Applications: Applications overview, Tags and classification, Custom applications, Desktop applications, Application tags, Application groups
• Concepts: Pagination