Prisma Browser API: Developer Guide
The guide for developers integrating with the Prisma Browser Management API. It explains how the API works, the patterns you must understand to automate safely (draft and publish, delta patch), and walks through common use cases with runnable code.
Download the full guide as one Markdown file to drop into ChatGPT, Claude, or any LLM, or point your tools at /prisma-browser/llms.txt.
Who this is for
Developers who want to manage Prisma Browser configuration programmatically instead of clicking through Strata Cloud Manager. The guide assumes you are comfortable with REST, JSON, and OAuth2, but not with Prisma Browser internals. For information about how the product works, see the Prisma Browser User Guide.
Start here
New to the API? Start with Getting started: get a token, read your live policy, create a test application, and publish it in under 10 minutes.
Basics
Read these to build a mental model before you write automation.
| Page | Covers |
|---|---|
| Authentication | OAuth2 client-credentials, Bearer token, roles |
| Draft and publish | configurationVersion, draft vs active, the publish action |
| Delta patch | Scalar set vs full-list replace vs add/remove delta |
| Partial publish | Publish only specific objects, not the whole draft |
| Direct actions | Immediate actions on live users and devices, outside the draft model |
| Pagination | Cursor pagination, the pageInfo envelope, and opt-in totalCount |
| Errors | The typed error envelope, error codes, and how to handle common statuses |
Inventory
Observed identities and endpoints in your tenant. Inventory objects are read-only apart from direct actions.
| Page | Object |
|---|---|
| Users | Observed identities; list, filter, and act on users |
| Devices | Observed endpoints; list, filter by posture, and act on devices |
Policy objects
The objects you create and reference from rules.
| Page | Object |
|---|---|
| Applications | Overview of application types and shared operations |
| Custom apps | Define a SaaS or web application by its URLs |
| Private apps | Define an internal application routed through Prisma Access |
| Non-web apps | Define an RDP or SSH remote connection by address, protocol, and port |
| Desktop apps | Define a local desktop application by its executables |
| Application groups | Group applications and reference the group from a rule |
| User groups | Local and identity provider (IdP)-synced groups; membership edits |
| Device groups | Posture-based device membership |
Policy
How policy is structured, and the fields and structure specific to each policy type.
| Page | Covers |
|---|---|
| Policy overview | Rules, sections, positions, scope, action vs controls, prompts, custom messages |
| Sign-in rules | Mandatory fields and structure for sign-in rules |
| Access and data rules | Applications, access, login controls, data controls, Data Loss Prevention (DLP) |
| Security rules | Controls-based rules for hardening the Prisma Browser |
| Customization rules | Controls-based rules for branding and look-and-feel |
| Assets | Upload logos, icons, images, and Proxy Auto-Configuration (PAC) files, then reference them by ID |
User requests
| Page | Covers |
|---|---|
| User requests | How admin-approval prompts generate requests, and the API to list, approve, decline, and revoke them |
Use cases (task walkthroughs)
End-to-end, copy-pasteable recipes for real jobs.
| Page | Task |
|---|---|
| Create and publish a rule | Author a rule on the draft, verify it, publish it |
| Change a rule's scope | Add, remove, or retarget who a rule applies to |
| Reorder rules and sections | Change evaluation order with full or partial position updates |
| Govern URLs with an allow/block list | Three ways to govern a list of URLs from automation |
| Bulk-sync a rule's applications | Keep a rule's application list in sync with an external source |
| Manage login and data controls | Set login and data controls on an access and data rule |
| Set a DLP profile on a rule | Discover DLP profile IDs and attach one to a rule |
| Require an IdP authentication factor | Discover a CIE authentication profile and require it as a factor on a security rule |
| Rotate cloud storage credentials | Configure a OneDrive/Drive provider and rotate its credentials with no downtime |
| Manage allowed browser extensions | Curate the allowed-extensions list on a security rule |
| Add or remove users on a rule | Add or remove users directly, or via a local user group |
| Roll out a rule gradually | Expand a rule's scope batch by batch over time |
| Handle user access requests | Poll, approve/decline, and revoke admin-approval requests |
| Publish a single object (partial publish) | Edit an object and publish only that object |
| Suspend a compromised user | Suspend a user immediately (incident response, offboarding) |
| Quarantine a lost or compromised device | Suspend, archive, or remove a device immediately |