Strata Cloud Manager API Release Notes
These release notes identify API changes made for the various Strata Cloud Manager services.
September 2026
Strata Cloud Manager — Compliance Frameworks (Updated)
Additional endpoint and schema updates for the Compliance Frameworks APIs.
See Compliance Frameworks APIs for full details.
NGFW, SASE — Logical Routers API (Updated)
Updated Logical Routers API for NGFW and SASE. Use these APIs to list, create, retrieve, update, and delete logical routers.
| Method | Endpoint | Description |
|---|---|---|
| GET | /logical-routers | List logical routers |
| POST | /logical-routers | Create a logical router |
| GET | /logical-routers/{id} | Get a logical router |
| PUT | /logical-routers/{id} | Update a logical router |
| DELETE | /logical-routers/{id} | Delete a logical router |
See Logical Routers API for full details.
NGFW, SASE — Virtual Routers API (Updated)
Updated Virtual Routers API for NGFW and SASE. Use these APIs to list, create, retrieve, update, and delete virtual routers.
| Method | Endpoint | Description |
|---|---|---|
| GET | /virtual-routers | List virtual routers |
| POST | /virtual-routers | Create a virtual router |
| GET | /virtual-routers/{id} | Get a virtual router |
| PUT | /virtual-routers/{id} | Update a virtual router |
| DELETE | /virtual-routers/{id} | Delete a virtual router |
See Virtual Routers API for full details.
NGFW, SASE — VR Routing Profiles API (Updated)
Updated VR Routing Profiles API for NGFW and SASE. Manage BGP, OSPF, OSPFv3, BFD, and redistribution profiles for virtual routers.
| Method | Endpoint | Description |
|---|---|---|
| GET | /bgp-vr-auth-profiles | List BGP VR auth profiles |
| POST | /bgp-vr-auth-profiles | Create a BGP VR auth profile |
| GET | /ospf-vr-auth-profiles | List OSPF VR auth profiles |
| POST | /ospf-vr-auth-profiles | Create an OSPF VR auth profile |
| GET | /vr-bfd-profiles | List VR BFD profiles |
View all endpoints (30)
| Method | Endpoint | Description |
|---|---|---|
| GET | /bgp-vr-auth-profiles | List BGP VR auth profiles |
| POST | /bgp-vr-auth-profiles | Create a BGP VR auth profile |
| GET | /bgp-vr-auth-profiles/{id} | Get a BGP VR auth profile |
| PUT | /bgp-vr-auth-profiles/{id} | Update a BGP VR auth profile |
| DELETE | /bgp-vr-auth-profiles/{id} | Delete a BGP VR auth profile |
| GET | /ospf-vr-auth-profiles | List OSPF VR auth profiles |
| POST | /ospf-vr-auth-profiles | Create an OSPF VR auth profile |
| GET | /ospf-vr-auth-profiles/{id} | Get an OSPF VR auth profile |
| PUT | /ospf-vr-auth-profiles/{id} | Update an OSPF VR auth profile |
| DELETE | /ospf-vr-auth-profiles/{id} | Delete an OSPF VR auth profile |
| GET | /ospfv3-vr-auth-profiles | List OSPFv3 VR auth profiles |
| POST | /ospfv3-vr-auth-profiles | Create an OSPFv3 VR auth profile |
| GET | /ospfv3-vr-auth-profiles/{id} | Get an OSPFv3 VR auth profile |
| PUT | /ospfv3-vr-auth-profiles/{id} | Update an OSPFv3 VR auth profile |
| DELETE | /ospfv3-vr-auth-profiles/{id} | Delete an OSPFv3 VR auth profile |
| GET | /vr-bfd-profiles | List VR BFD profiles |
| POST | /vr-bfd-profiles | Create a VR BFD profile |
| GET | /vr-bfd-profiles/{id} | Get a VR BFD profile |
| PUT | /vr-bfd-profiles/{id} | Update a VR BFD profile |
| DELETE | /vr-bfd-profiles/{id} | Delete a VR BFD profile |
| GET | /vr-redistribution-profiles | List VR redist profiles |
| POST | /vr-redistribution-profiles | Create a VR redist profile |
| GET | /vr-redistribution-profiles/{id} | Get a VR redist profile |
| PUT | /vr-redistribution-profiles/{id} | Update a VR redist profile |
| DELETE | /vr-redistribution-profiles/{id} | Delete a VR redist profile |
| GET | /vr-redistribution-profiles-ipv6 | List VR redist IPv6 profiles |
| POST | /vr-redistribution-profiles-ipv6 | Create a VR redist IPv6 profile |
| GET | /vr-redistribution-profiles-ipv6/{id} | Get a VR redist IPv6 profile |
| PUT | /vr-redistribution-profiles-ipv6/{id} | Update a VR redist IPv6 profile |
| DELETE | /vr-redistribution-profiles-ipv6/{id} | Delete a VR redist IPv6 profile |
See VR Routing Profiles API for full details.
Strata Cloud Manager — Activation Service and Asset Service APIs (New)
Added Activation Service APIs and Asset Service APIs to SCM. These APIs enable programmatic management of tenant activation, license allocation, and instance lifecycle operations.
| Method | Endpoint | Description |
|---|---|---|
| POST | /activation/api/v1/shared-instances | Share a CIE instance with child TSGs |
| POST | /activation/api/v1/activate | Activate or amend Prisma Access licenses |
| GET | /activation/api/v1/offboard/validation | Validate offboard readiness |
| POST | /activation/api/v1/offboard | Offboard a product instance |
| GET | /asset/api/v1/entitlement-groups | Fetch entitlement group details |
| GET | /asset/api/v1/instances | Get product instance status |
August 2026
NGFW, SASE — Routing APIs (New)
New R3 routing APIs introduce Logical Routers, Virtual Routers, and VR Routing Profiles for both NGFW and SASE platforms, enabling programmatic management of routing topologies and routing policy profiles.
View endpoints
NGFW Logical Routers
| Method | Endpoint | Description |
|---|---|---|
| GET | /config/network/v1/logical-routers | List logical routers |
| POST | /config/network/v1/logical-routers | Create a logical router |
| GET | /config/network/v1/logical-routers/{id} | Get a logical router |
| PUT | /config/network/v1/logical-routers/{id} | Update a logical router |
| DELETE | /config/network/v1/logical-routers/{id} | Delete a logical router |
NGFW Virtual Routers
| Method | Endpoint | Description |
|---|---|---|
| GET | /config/network/v1/virtual-routers | List virtual routers |
| POST | /config/network/v1/virtual-routers | Create a virtual router |
| GET | /config/network/v1/virtual-routers/{id} | Get a virtual router |
| PUT | /config/network/v1/virtual-routers/{id} | Update a virtual router |
| DELETE | /config/network/v1/virtual-routers/{id} | Delete a virtual router |
NGFW VR Routing Profiles
| Method | Endpoint | Description |
|---|---|---|
| GET | /config/network/v1/vr-routing-profiles | List VR routing profiles |
| POST | /config/network/v1/vr-routing-profiles | Create a VR routing profile |
| GET | /config/network/v1/vr-routing-profiles/{id} | Get a VR routing profile |
| PUT | /config/network/v1/vr-routing-profiles/{id} | Update a VR routing profile |
| DELETE | /config/network/v1/vr-routing-profiles/{id} | Delete a VR routing profile |
SASE Logical Routers
| Method | Endpoint | Description |
|---|---|---|
| GET | /config/network/v1/logical-routers | List logical routers |
| POST | /config/network/v1/logical-routers | Create a logical router |
| GET | /config/network/v1/logical-routers/{id} | Get a logical router |
| PUT | /config/network/v1/logical-routers/{id} | Update a logical router |
| DELETE | /config/network/v1/logical-routers/{id} | Delete a logical router |
SASE Virtual Routers
| Method | Endpoint | Description |
|---|---|---|
| GET | /config/network/v1/virtual-routers | List virtual routers |
| POST | /config/network/v1/virtual-routers | Create a virtual router |
| GET | /config/network/v1/virtual-routers/{id} | Get a virtual router |
| PUT | /config/network/v1/virtual-routers/{id} | Update a virtual router |
| DELETE | /config/network/v1/virtual-routers/{id} | Delete a virtual router |
SASE VR Routing Profiles
| Method | Endpoint | Description |
|---|---|---|
| GET | /config/network/v1/vr-routing-profiles | List VR routing profiles |
| POST | /config/network/v1/vr-routing-profiles | Create a VR routing profile |
| GET | /config/network/v1/vr-routing-profiles/{id} | Get a VR routing profile |
| PUT | /config/network/v1/vr-routing-profiles/{id} | Update a VR routing profile |
| DELETE | /config/network/v1/vr-routing-profiles/{id} | Delete a VR routing profile |
See NGFW Network Services APIs and SASE Network Services APIs for full details.
NGFW — Device Settings API (New)
Comprehensive R3 Device Settings API for NGFW providing full programmatic control over device-level configuration including interfaces, zones, service routes, high availability, DNS, NTP, and more.
See NGFW Device Settings APIs for full details.
NGFW, SASE — Application Tags API (New)
New R3 Application Tags APIs enable management of application tag definitions for both NGFW and SASE platforms, supporting dynamic policy grouping and application classification workflows.
| Method | Endpoint | Description |
|---|---|---|
| GET | /config/objects/v1/application-tags | List application tags |
| POST | /config/objects/v1/application-tags | Create an application tag |
| GET | /config/objects/v1/application-tags/{id} | Get an application tag |
| PUT | /config/objects/v1/application-tags/{id} | Update an application tag |
| DELETE | /config/objects/v1/application-tags/{id} | Delete an application tag |
See NGFW Network Services APIs and SASE Network Services APIs for full details.
Cloud NGFW — Application Tags API (New)
R3 Application Tags support extended to Cloud NGFW, providing consistent application tagging and policy grouping across all three platforms.
| Method | Endpoint | Description |
|---|---|---|
| GET | /config/objects/v1/application-tags | List application tags |
| POST | /config/objects/v1/application-tags | Create an application tag |
| GET | /config/objects/v1/application-tags/{id} | Get an application tag |
| PUT | /config/objects/v1/application-tags/{id} | Update an application tag |
| DELETE | /config/objects/v1/application-tags/{id} | Delete an application tag |
See Cloud NGFW APIs for full details.
SASE — Deployment Services API (Updated)
R3 update to the Deployment Services API introduces expanded service management capabilities for SASE deployments.
See SASE Network Services APIs for full details.
NGFW, SASE — Network Services API (Updated)
R3 release of the Network Services API for both NGFW and SASE platforms with updated schemas and expanded endpoint coverage.
See NGFW Network Services APIs and SASE Network Services APIs for full details.
Config Operations, Config Setup, Device Onboarding — R3 Updates (Updated)
R3 release updates across Config Operations, Config Setup, and Device Onboarding APIs for SASE, NGFW, and Cloud NGFW platforms with improved schemas and additional endpoint coverage.
See Configuration Operations APIs for full details.
Identity Services, Security Services, Objects — R3 Updates (Updated)
R3 release updates to Identity Services, Security Services, and Objects APIs across SASE, NGFW, and Cloud NGFW platforms with schema improvements and expanded resource management capabilities.
See Identity Services APIs, Security Services APIs, and Objects APIs for full details.
July 2026
Posture Management — Compliance Framework APIs (New)
Programmatic access to compliance framework configurations and assessment results.
| Method | Endpoint | Description |
|---|---|---|
| GET | /posture/v1/compliance-frameworks | List compliance frameworks |
| GET | /posture/v1/compliance-frameworks/{id} | Get compliance framework details |
| GET | /posture/v1/compliance-assessments | List compliance assessment results |
See Compliance Framework APIs for full details.
Advanced DNS Security Resolver — Schema Improvements (Updated)
Improved validation constraints, required fields for EDL definitions, and SafeSearch/YouTube restricted mode filtering options.
See Advanced DNS Security Resolver APIs for full details.
Prisma AIRS AI Red Teaming — Adapter Endpoints (New)
Manage custom adapters for AI Red Teaming targets including create, list, get, update, delete, validate, and retrieve configuration defaults.
View endpoints (7)
| Method | Endpoint | Description |
|---|---|---|
| POST | /airs/redteam/v1/adapters | Create a custom adapter |
| GET | /airs/redteam/v1/adapters | List all adapters |
| GET | /airs/redteam/v1/adapters/{id} | Get adapter by ID |
| PUT | /airs/redteam/v1/adapters/{id} | Update an adapter |
| DELETE | /airs/redteam/v1/adapters/{id} | Delete an adapter |
| POST | /airs/redteam/v1/adapters:validate | Validate adapter configuration |
| GET | /airs/redteam/v1/adapters/defaults | Retrieve configuration defaults |
See Prisma AIRS AI Red Teaming APIs for full details.
Network Configuration — Generate PPK Key (New)
Generate a cryptographically strong Post-Quantum Pre-Shared Key (RFC 8784) for use in IKE gateway PPK configuration.
| Method | Endpoint | Description |
|---|---|---|
| POST | /config/network/v1/ike-gateways:generate-ppk | Generate a PPK key for IKE gateways |
See Network Services APIs for full details.
Identity and Security Services — Spec Consolidation (Updated)
Consolidated spec files and improved schemas across SASE, NGFW, and Cloud NGFW platforms for Identity Services and Security Services.
See Identity Services APIs for full details.
June 2026
NGFW Device Onboarding — Site Management APIs (New)
Manage site configurations as part of the NGFW device onboarding workflow.
See Site Management APIs for full details.
SASE Deployment — Network Deployment Endpoints (Updated)
Expanded deployment automation capabilities for SASE network configurations with new endpoints.
See Network Deployment APIs for full details.
Objects Configuration — New Object Schemas (Updated)
New object schemas for SASE, NGFW, and Cloud NGFW configurations that enhance configuration management across all platform types.
See Objects APIs for full details.
NGTS — TLS Protect Cloud APIs (New)
Manage TLS certificate lifecycles and protection policies through Strata Cloud Manager.
See NGTS TLS Protect Cloud APIs for full details.
May 2026
Terraform Provider — SCM Provider Documentation (New)
Infrastructure-as-code management of Strata Cloud Manager configurations using Terraform.
See SCM Terraform Provider for full details.
Advanced DNS Security Resolver — Initial Release (New)
Configuration and management of advanced DNS security resolver settings.
See Advanced DNS Security Resolver APIs for full details.
NGFW Operations — Operations APIs (New)
Operational management of NGFW devices through Strata Cloud Manager.
See NGFW Operations APIs for full details.
Security Services, Network Services, NGFW Operations — Additional Endpoints (Updated)
Additional endpoints and schema updates across Security Services, Network Services, and NGFW Operations APIs.
See Security Services, Network Services, and NGFW Operations for full details.
April 2026
Cloud Dynamic User Groups (CDUG) — CDUG APIs (New)
Dynamic grouping of users based on cloud identity attributes for policy enforcement.
See Cloud Dynamic User Groups (CDUG) APIs for full details.
NGFW Device Settings — HA Configurations (New)
High Availability configuration management for NGFW devices via Device Settings APIs.
See Device Settings APIs for full details.
March 2026
Configuration Operations, Security Services — Additional Endpoints (Updated)
Additional endpoints and improvements for Configuration Operations and Security Services APIs.
See Configuration Operations APIs for full details.
Posture Management — Posture APIs (New)
Programmatic management of security posture assessments and policies.
See Posture APIs for full details.
Incidents — Incidents APIs (New)
Programmatically query, manage, and respond to security incidents.
See Incidents APIs for full details.
January 2026
Best Practices — API Best Practices Guide (New)
Recommended patterns for API integration, error handling, and configuration management.
See Strata Cloud Manager Best Practices for full details.
October 2025
CIE Directory Sync Service — Directory Sync APIs (New)
Directory synchronization capabilities between Cloud Identity Engine and external identity sources.
See CIE Directory Sync Service APIs for full details.
June 2025
Setup — Snippet Sharing APIs (New)
Reusable configuration templates that can be shared across folders and devices.
See Snippet Sharing APIs for full details.
May 2025
Security Services — Unified Rulebase Policies (New)
Introduced Security and Internet policy types for Security Rules, supporting the unified rulebase experience where traditional security rules and Web Security rules are managed through a common endpoint.
See Security Services APIs for full details.
February 2025
Prisma Access — Configuration Orchestration APIs (New)
Orchestrated, workflow-based configuration management for Prisma Access deployments.
See Prisma Access Configuration Orchestration APIs for full details.
January 2025
SaaS Security Posture Management — SSPM APIs (New)
Manage SaaS application security posture policies, run assessments, and automate remediation workflows.
See SaaS Security Posture Management APIs for full details.
November 2024
Strata Cloud Manager — Configuration APIs (New)
Major platform release introducing the Strata Cloud Manager configuration APIs and landing page. See the detailed November 2024 release notes for more information.
View highlights (9)
| Area | Change |
|---|---|
| API Platform FQDN | Updated to api.strata.paloaltonetworks.com (original api.sase.paloaltonetworks.com continues to work) |
| Configuration API Base Paths | Reorganized along functional lines (/config/setup/v1, /config/deployment/v1, /config/security/v1, /config/objects/v1, /config/network/v1, /config/identity/v1, /config/device/v1, /config/operations/v1) |
| POST/PUT/DELETE Query Params | Removed — resource location now specified in request body via folder, snippet, or device attributes |
| Security Rule Types | Added type attribute (security and internet) for unified rulebase |
| SCM Setup APIs | New: Folders, Snippets, Devices, Labels, Variables |
| NGFW Network Configuration | Comprehensive network management endpoints |
| NGFW Device Configuration | Device settings, HA, service routes, and more |
| Log Forwarding Configuration | Custom log forwarding profiles, HTTP/syslog server profiles |
| DoS Protection Configuration | DoS protection profiles and rules |
October 2024
Prisma Access Browser — Browser Management APIs (New)
Management of Prisma Access Browser configurations and policies.
See Prisma Access Browser APIs for full details.
Aggregate Monitoring — Additional Endpoints (Updated)
Expanded monitoring capabilities for tenant resources.
See Aggregate Monitoring APIs for full details.
July 2024
Multitenant Interconnect — Interconnect APIs (New)
Management of interconnect configurations across multiple tenants.
See Multitenant Interconnect APIs for full details.
April 2024
Multitenant Notifications — Notification APIs (New)
Configure and manage notification policies for multitenant SASE deployments.
See Multitenant Notification APIs for full details.
September 2023
Prisma Access — Autonomous DEM APIs (New)
Access digital experience management data including application and agent scores.
See Autonomous DEM APIs and ADEM API Examples for full details.
May 2023
Identity and Access Management — Custom Roles and Permission Sets (New)
Fine-grained access control with custom roles and permission sets.
| Method | Endpoint | Description |
|---|---|---|
| GET/POST | /iam/v1/custom-roles | Manage custom roles |
| GET/POST | /iam/v1/permission-sets | Manage permission sets |
See Custom Roles and Permission Sets for full details.
April 2023
Prisma Access — ZTNA Connector APIs (New)
ZTNA Connector APIs for Zero Trust Network Access management.
See SASE Release Notes for full details.
March 2023
Prisma Access — Configuration Endpoints (Updated)
New endpoints for Prisma Access Configuration APIs.
See SASE Release Notes for full details.
December 2022
Subscription Service — License Allocation Endpoints (New)
Allocate licenses to tenant service groups.
See Subscription Service for full details.
November 2022
Prisma Access — Mobile Agent Endpoints (New)
Mobile Agent (GlobalProtect) endpoints added to Prisma Access configuration.
See SASE Release Notes for full details.
Prisma Access — Insights Examples (New)
Published examples for Prisma Access Insights API usage.
See Prisma Access Insights examples for full details.
October 2022
Aggregate Monitoring — New Endpoints and Query Filters (Updated)
Additional endpoints and query filters for aggregate monitoring.
See SASE Release Notes for full details.
Cortex Data Lake — Log Forwarding Authentication Update (Updated)
Log Forwarding APIs now use the common SASE authentication mechanism.
See Log Forwarding APIs for full details.
August 2022
Prisma Access Configuration, Aggregate Monitoring — Updates (Updated)
New endpoints for Prisma Access Config APIs and updated Aggregate Monitoring APIs.
See August 2022 release notes for full details.
July 2022
Prisma SD-WAN, Prisma Access — Multi-Product Update (New)
Added Prisma SD-WAN documentation, and updates to Prisma Access Configuration and Insights APIs.
See SASE Release Notes for full details.
June 2022
IAM — User Account Documentation (Updated)
Published additional information about IAM user accounts.
See IAM user accounts for full details.
May 2022
IAM — User Account APIs (New)
User Account API endpoints for the IAM service.
See User Account APIs for full details.
Prisma Access — Configuration Monthly Release (Updated)
Monthly release with breaking changes to Prisma Access Configuration APIs.
See breaking changes for full details.
April 2022
Prisma Access Insights, Prisma SASE — Initial Platform Release (New)
First public release of Prisma SASE APIs for MSSPs, including Prisma Access Insights v1.0 and v2.0 APIs. Corrected base URLs, fixed bugs, and added release notes.
See SASE Release Notes for full details.