The Preview features guide explains how preview operations work: find an operation's feature name, opt in with the x-prisma-browser-preview header, and what changes when the operation reaches general availability.
The new System limits guide covers the limits on every call: 600 requests per minute per tenant (every operation documents 429 with the RateLimit-Limit and RateLimit-Remaining headers), a page limit from 1 to 1,000 with a default of 100, and request and response size, including 500 with RESPONSE_TOO_LARGE.
The new Entity limits guide lists how many objects a tenant can hold, how large a stored list can grow, and how many items one bulk call or upload accepts. Several maximums are new in this release, for example 1,000 rules per policy type and 10,000 IDs per device or user action.
Entity limitsPartial publish lets automation publish exactly the objects it changed, and nothing else, so scripts run safe, scoped changes without the risk of publishing unrelated draft edits. Policy rules and sections are not supported yet. This operation is in preview: send x-prisma-browser-preview: partial-publish.
Application tags have their own endpoints: list, create, read, update and delete a tag. These operations are in preview: send x-prisma-browser-preview: application-tags.
Add or remove tags, or set the classification, on up to 500 applications in one request. This operation is in preview: send x-prisma-browser-preview: application-tags.
List applications and List applications by type filter by classification, tagId and tagName. Pass several values as a comma-separated list. tagId and tagName cannot be combined.
Catalog and local desktop catalog applications accept PATCH to set classification and tagIDs.
List the members of a user group in the draft or the active configuration with configurationVersion, so you can check who a group holds before and after you publish. This operation is in preview: send x-prisma-browser-preview: user-group-members.
The Customization eula control shows an End User License Agreement that users must accept. Upload the HTML body, then set the returned eulaId as contentId. The upload is in preview: send x-prisma-browser-preview: eula-upload.
The Customization webAppForceList control force-installs up to 50 web apps (PWAs) that users cannot uninstall. For a custom icon, upload it and reference it by webAppIconId, or set iconUrl and iconHash.
New Customization controls: networkErrorPopover shows or hides the Troubleshooting Tips on network error pages, and adminMessages messages accept pushMessage to open the admin messages dialog on the New Tab page.
IDP-synced shortcuts accept idpProvider of okta or entraID. For entraID, set idpAppsProviderId to an enabled Entra ID application sync provider. Omit it when the control is disabled.
The Security hardwareBackedKeysProtection control protects the Prisma Browser's cryptographic keys with TPM and platform key stores.
The Security sessionRefresh control accepts inactivityTimeout, from 1 minute to 1 hour of idle time before the user must re-authenticate.
The Security forceHttps control accepts blockBypass to remove the option to proceed past the HTTPS warning page.
Access and Data rules accept the userAgent and customHttpHeader controls under dataControls.
The Access and Data webUserInteraction control accepts a per-selector action of hide, disable or mask. hide remains the default.
Non-web applications accept rdsGatewayHostname and bypassRdsGatewayForLocalAddresses for the rdp protocol, and private applications accept iconId for a custom icon.
Access and Data rule tenant restrictions (applications.tenantConditions) take a per-application apps list, OpenAI restrictions accept planTypes and structures, and AWS restrictions accept six more regions.
Application plugin elements accept an elementType of excludePasswordRevealBlock. It turns off Account Protection password-reveal blocking (the Access and Data formLogin control's accountProtection) on a site that matches urlPattern. Password protection itself is unaffected.
Access and Data rules set the Enterprise DLP data profile in a new top-level dlp object: profileId, bypassProfileValidation and detectionConfidence (relaxed or strict). The previous fields, dataControls.dlpProfileId, dataControls.dlpProfile and dataControls.bypassDlpProfileValidation, still work and are moving to dlp.profileId, dlp.profile and dlp.bypassProfileValidation.