Activation Service APIs
The Activation Service API enables you to manage the full lifecycle of tenant activation. You can use this API to share instances across tenant service groups, activate and amend licenses, and offboard product instances when they are no longer needed.
These APIs are designed for system administrators and automation teams managing multi-tenant deployments. They support programmatic onboarding of child tenants, license capacity management, and controlled decommissioning.
Authentication
The Activation Service API uses OAuth 2.0 client credentials flow. Obtain an access token from:
https://iam.apps.paloaltonetworks.com/oauth2/access_token
Include the token in the Authorization header:
Authorization: Bearer <ACCESS_TOKEN>
Required OAuth scopes vary by operation:
| Operation | Scope |
|---|---|
| Share instance | activation_service.shared_instances.create |
| Activate/amend license | activation_service.activate.create |
| Validate offboard | activation_service.offboard.validate |
| Offboard instance | activation_service.offboard.create |
For detailed authentication steps, refer to the Strata Cloud Manager authentication guide.
Base URL
https://api.sase.paloaltonetworks.com