Palo Alto Prisma Access Browser Integration Guide

Overview

The Palo Alto Prisma Access Browser (PAB) integration connects your NINA workflows to the Prisma Access Browser Management API, enabling comprehensive browser security management operations. This integration lets you manage browser users and devices, configure security policies and deployments, organize resources into groups, manage applications and plugins, handle user access requests, publish configuration changes, and retrieve usage reports — all directly from your workflows.

Prisma Access Browser is Palo Alto Networks' enterprise-managed Chromium-based browser that enforces zero-trust security controls at the browser layer. It provides data loss prevention (DLP), web filtering, extension governance, and identity-based access controls without requiring a VPN or network proxy.

Status

We currently support 12 resources across the full Prisma Access Browser Management API surface:

Users: List, retrieve, suspend, resume, and force re-authentication of enrolled browser users
Devices: List, retrieve, archive, restore, suspend, resume, delete, and force re-authentication of managed browser devices; all mutating actions operate on device ID arrays
Device Groups: List, retrieve, create, fully replace, partially update, and delete logical device groupings
User Groups: List, retrieve, create, fully replace, and delete logical user groupings
Applications: List (all and by type), retrieve (by ID and by type+ID), create, patch, delete, bulk-create, bulk-delete, and list application categories
Application Groups: List, retrieve, create, patch, and delete application groupings used for policy assignment
Plugins: List all plugins, retrieve by application, create, fully replace, and delete plugin configurations attached to applications
User Requests: List, retrieve, action (approve/deny), and revoke user access requests
Configuration Management: Publish the current draft configuration to make it the active version
Policies: List, retrieve, create, fully replace, and delete browser security policies (web filtering, DLP, extension controls, download controls)
Deployments: List, retrieve, create, fully replace, and delete browser deployment configurations per platform
Reports: Retrieve usage reports (active users, sessions, data transferred, threats blocked, DLP events) for a specified date range

Credential Configuration

Before using the Prisma Access Browser integration in your workflows, you need to configure OAuth 2.0 client credentials through the Palo Alto Networks SASE portal. The integration uses the OAuth 2.0 client credentials flow against the Palo Alto Networks identity platform.

Authentication Method

OAuth2 Client Credentials

Field	Description	Example
Client ID	OAuth 2.0 client ID of the SASE service account	`client_id_xxxxxxxxxxxxxxxxxxxxxxxx`
Client Secret	OAuth 2.0 client secret of the SASE service account	`client_secret_xxxxxxxxxxxxxxxxxxxxxxxx`
Tenant ID	Prisma Access tenant identifier (TSG ID) used to scope the access token	`1234567890`
Base URL	SEB API base URL. Do not change unless instructed by Palo Alto Networks support.	`https://api.sase.paloaltonetworks.com/seb-api`

Token endpoint (managed internally by the connector):

https://auth.apps.paloaltonetworks.com/oauth2/access_token

The connector acquires a bearer token using the client_credentials grant and sends it on every subsequent request as Authorization: Bearer <token>. Tokens are cached and refreshed automatically.

Additional header sent on every request:

prisma-tenant: <TenantID>

This header scopes all API calls to your specific tenant. If it is missing or incorrect, the API returns 401 Unauthorized.

How to Create a SASE Service Account and API Client

The Prisma Access Browser API uses Palo Alto Networks SASE service accounts (also called API clients or service principals), not user accounts. Follow these steps in the Strata Cloud Manager (SCM) or the SASE Identity Platform:

Sign in to Strata Cloud Manager with a Super User or Identity Administrator role.
Navigate to Settings > Identity & Access > Service Accounts (or API Clients depending on your tenant version).
Click Add Service Account (or Add API Client).
Provide a descriptive name (e.g., NINA-PAB-Integration) and an optional description.
Select the scope for the service account:
- For full read/write access: assign the Super User role.
- For read-only workflows: assign the View-Only Administrator role.
Click Create and note the Client ID displayed on the summary screen.
Click Generate Secret to create the client secret. Copy the value immediately — it will not be shown again.
Note the Tenant ID (TSG ID) shown in the top-right corner of the SCM portal or under Settings > Tenant Information.

Important: The Client Secret is shown only once at creation time. If you lose it, you must delete the service account and create a new one — there is no way to retrieve an existing secret.

Required Roles and Permissions

The Prisma Access Browser API uses role-based access control (RBAC) at the service account level. There are no granular per-resource permission scopes — access is controlled by the assigned role.

Role	Access Level	Recommended for
Super User	Full read and write access to all resources	Workflows that create, update, or delete users, devices, groups, applications, policies, deployments, or publish configurations
View-Only Administrator	Read-only access; list and get operations only	Workflows that only read data (auditing, reporting, monitoring)

Note: Mutating operations such as configManagement.publish, device.suspend, application.bulkDelete, and policy.create require Super User role. Using a View-Only Administrator credential for these operations will result in 403 Forbidden responses.

Dual API Base URL Routing

The Prisma Access Browser connector automatically routes requests to two different API base URLs depending on the resource:

API Surface	Base URL	Used for
SEB API	`https://api.sase.paloaltonetworks.com/seb-api`	Users, Devices, Device Groups, User Groups, Applications, Application Groups, Plugins, User Requests, Configuration Management
Browser Management API	`https://api.sase.paloaltonetworks.com/browser-mgmt`	Policies, Deployments, Reports

You do not need to configure this routing — the connector handles it automatically based on the path prefix. The baseUrl credential field controls only the SEB API base URL. Browser-mgmt paths are always derived from the same SASE API domain.

Tenant availability note: The Browser Management API (/browser-mgmt/v1/... endpoints) is not available on all tenants. If policy.list, deployment.list, or report.getUsage return 404 Not Found, the browser-mgmt feature may not be enabled for your tenant. Contact Palo Alto Networks support to verify entitlement.

Creating a Prisma Access Browser Credential

Navigate to the Credentials section in NINA.
Click Add New Credential.
Fill in the credential details:
- Name: A descriptive name (e.g., PAB Production)
- Description: Optional details about the credential's purpose
- Integration Service: Select Palo Alto Prisma Access Browser
- Auth Type: Select OAuth2
- Client ID: Enter the client ID from your SASE service account
- Client Secret: Enter the client secret value
- Tenant ID: Enter your TSG ID
- Base URL: Leave blank for production (defaults to https://api.sase.paloaltonetworks.com/seb-api)
Click Test Connection to verify the credentials — this acquires an OAuth token from the Palo Alto identity platform to confirm they are valid.
Click Save to store the credential.

Supported Resources and Operations

User

Manage browser users enrolled in the Prisma Access Browser. Users are created automatically when they first sign in — they cannot be created via the API.

Operation	Name	Description
`list`	List Users	Retrieve all enrolled users with identity, status, assigned policy, and active session count
`get`	Get User by ID	Retrieve full details for a specific user
`suspend`	Suspend User	Suspend a user, preventing them from opening new browser sessions
`resume`	Resume User	Resume a suspended user, restoring browser access
`forceReauth`	Force Re-authentication	Force the user to re-authenticate on their next browser session

Key parameters:

id (required for get, suspend, resume, forceReauth) — the unique user ID returned by user.list

Note: List endpoints accept no query parameters. The live API rejects unknown query parameters with HTTP 400. All filtering must be applied to the response data in downstream workflow nodes.

Device

Manage devices enrolled in the Prisma Access Browser. All mutating operations accept an array of device IDs, enabling bulk actions.

Operation	Name	Description
`list`	List Devices	Retrieve all managed devices with hostname, platform, browser version, and compliance status
`get`	Get Device by ID	Retrieve full details for a specific enrolled device
`archive`	Archive Devices	Change device status to archived (soft delete)
`restore`	Restore Archived Devices	Restore archived devices to active status
`suspend`	Suspend Devices	Prevent devices from establishing new browser sessions
`resume`	Resume Suspended Devices	Restore browser access to suspended devices
`delete`	Delete Devices	Permanently delete one or more devices (suspended devices must be resumed first)
`forceReauth`	Force Re-authentication	Force re-authentication on one or more devices

Key parameters for bulk operations (archive, restore, suspend, resume, delete, forceReauth):

deviceIds (required) — array of device IDs; at least one ID must be provided

Pre-hook validation: The connector validates deviceIds before sending the request. If the array is empty or missing, the operation fails immediately with a validation error.

Delete constraint: Suspended devices cannot be deleted. You must resume them before calling delete.

Device Group

Organise enrolled devices into logical groups for policy assignment and reporting.

Operation	Name	Description
`list`	List Device Groups	Retrieve all device groups
`get`	Get Device Group by ID	Retrieve full details for a specific device group
`create`	Create Device Group	Create a new device group
`replace`	Replace Device Group	Fully replace the configuration of an existing device group (PUT)
`patch`	Patch Device Group	Apply a partial update to an existing device group
`delete`	Delete Device Group	Permanently delete a device group

Key parameters:

deviceGroupId (required for get, replace, patch, delete) — the unique device group ID
name (required for create, replace) — device group name
deviceIds (optional) — array of device IDs to include as static members
filters (optional) — object specifying dynamic group membership criteria

User Group

Organise enrolled users into logical groups for policy assignment.

Operation	Name	Description
`list`	List User Groups	Retrieve all user groups
`get`	Get User Group by ID	Retrieve full details for a specific user group
`create`	Create User Group	Create a new user group
`update`	Update User Group	Fully replace the configuration of an existing user group (PUT)
`delete`	Delete User Group	Permanently delete a user group

Key parameters:

id (required for get, update, delete) — the unique user group ID
name (required for create, update) — user group name
userIds (optional) — array of user IDs to include as members

Application

Manage application objects (web, SaaS, private) in the Prisma Access Browser. Applications define the resources that browser security policies and access controls apply to.

Operation	Name	Description
`list`	List Applications	Retrieve all application objects
`get`	Get Application by ID	Retrieve full details for a specific application
`delete`	Delete Application by ID	Delete an application by its generic ID
`listByType`	List Applications by Type	Retrieve applications filtered by type (`web`, `saas`, `private`)
`create`	Create Application	Create a new application of a specified type
`getByType`	Get Application by Type and ID	Retrieve a specific application identified by both type and ID
`patch`	Patch Application	Apply a partial update to an application by type and ID
`deleteByType`	Delete Application by Type	Delete an application identified by both type and ID
`listCategories`	List Application Categories	Retrieve available application category values
`bulkCreate`	Bulk Create Applications	Create multiple applications in a single request (partial success: HTTP 207)
`bulkDelete`	Bulk Delete Applications	Delete multiple applications by ID in a single request (partial success: HTTP 207)

Key parameters:

id (required for get, delete, getByType, patch, deleteByType) — application unique ID
type (required for listByType, create, getByType, patch, deleteByType) — application type: web, saas, or private
applications (required for bulkCreate) — array of application create request objects
applicationIds (required for bulkDelete) — array of application IDs to delete; at least one ID must be provided

listByType tenant note: On some tenants, the live API returns HTTP 400 invalid value for the type path parameter. If this occurs, use application.list and filter results downstream.

Bulk operation responses: Both bulkCreate and bulkDelete may return HTTP 207 Multi-Status, indicating partial success. Check the response body for per-item success/failure details.

Pre-hook validation for bulkDelete: The connector validates applicationIds before sending the request. An empty array causes an immediate validation error.

Application Group

Organise applications into logical groups for policy assignment.

Operation	Name	Description
`list`	List Application Groups	Retrieve all application groups
`get`	Get Application Group by ID	Retrieve full details for a specific application group
`create`	Create Application Group	Create a new application group
`patch`	Patch Application Group	Apply a partial update to an existing application group
`delete`	Delete Application Group	Permanently delete an application group

Key parameters:

id (required for get, patch, delete) — application group unique ID
name (required for create) — application group name
applicationIds (optional) — array of application IDs to include in the group

Plugin

Manage plugin configurations attached to applications. Each application may have one plugin configuration.

Operation	Name	Description
`list`	List Application Plugins	Retrieve all plugin configurations across all applications
`getByApplication`	Get Plugin by Application ID	Retrieve the plugin configuration for a specific application
`create`	Create Plugin for Application	Create a new plugin configuration for an application
`update`	Update Plugin for Application	Fully replace the plugin configuration for an application (PUT)
`delete`	Delete Plugin for Application	Delete the plugin configuration for an application

Key parameters:

id (required for getByApplication, create, update, delete) — the application ID whose plugin is managed
name (optional) — plugin name or type identifier
config (optional) — plugin-specific configuration fields as an object

getByApplication note: If an application has no plugin configured, the API returns HTTP 404. This is expected behaviour, not a code error.

User Request

Manage user access requests (extension install requests, site access requests) pending approval.

Operation	Name	Description
`list`	List User Requests	Retrieve all pending and historical user requests
`get`	Get User Request by ID	Retrieve full details for a specific user request
`action`	Act on User Request	Approve or deny a pending user request
`revoke`	Revoke User Request	Revoke a previously approved user request

Key parameters:

id (required for get, action, revoke) — user request unique ID
action (required for action) — approve or deny
reason (optional for action, revoke) — free-text reason recorded with the action

Configuration Management

Control the Prisma Access Browser draft configuration lifecycle. Changes made via the API (policies, deployments, applications, groups) are staged as a draft until published.

Operation	Name	Description
`publish`	Publish Draft	Publish the current draft configuration to make it the active version

publish behaviour:

Returns 200 OK with a success response on successful publication.
Returns 409 Conflict with message No pending changes found when the draft has no staged changes — this is not an error, it means the current active version is already up to date.
Returns 501 Not Implemented if draft mode is not supported on the tenant.

configManagement.publish takes no parameters. Send an empty parameters object {}.

Policy

Manage browser security policies controlling web filtering, DLP, extension permissions, and download controls. Uses the Browser Management API (/browser-mgmt/v1/...).

Operation	Name	Description
`list`	List Browser Security Policies	Retrieve all browser security policies configured for the tenant
`get`	Get Browser Security Policy	Retrieve full details for a specific policy
`create`	Create Browser Security Policy	Create a new browser security policy
`update`	Update Browser Security Policy	Fully replace an existing policy configuration (PUT)
`delete`	Delete Browser Security Policy	Delete a browser security policy

Key parameters:

policy_id (required for get, update, delete) — the unique policy ID (note: uses policy_id, not id)
name (required for create, update) — policy name
enabled (optional) — boolean; defaults to true
web_filtering (optional) — object containing web filtering configuration (e.g., enabled, blocked_categories)
dlp_enabled (optional) — boolean; whether data loss prevention is active
extension_policy (optional) — allow_all, allow_list, or block_all
download_control (optional) — allow, scan, or block
description (optional) — free-text policy description

Path parameter naming: Policy operations use policy_id as the path parameter name, matching the OpenAPI specification exactly. Do not use id.

Delete constraint: Policies assigned to active deployments must be unassigned from those deployments before deletion.

Deployment

Manage browser deployment configurations defining how the Prisma Access Browser is distributed and configured per platform. Uses the Browser Management API (/browser-mgmt/v1/...).

Operation	Name	Description
`list`	List Browser Deployments	Retrieve all deployment configurations
`get`	Get Browser Deployment	Retrieve full details for a specific deployment
`create`	Create Browser Deployment	Create a new deployment configuration for a platform
`update`	Update Browser Deployment	Fully replace an existing deployment configuration (PUT)
`delete`	Delete Browser Deployment	Delete a deployment configuration

Key parameters:

deployment_id (required for get, update, delete) — the unique deployment ID (note: uses deployment_id, not id)
name (required for create, update) — deployment name
platform (required for create, update) — target platform: windows, macos, linux, or chromeos
policy_id (optional) — ID of the browser security policy to attach to this deployment
update_channel (optional) — stable or beta; defaults to stable
description (optional) — free-text deployment description

Path parameter naming: Deployment operations use deployment_id as the path parameter name, matching the OpenAPI specification exactly. Do not use id.

Report

Retrieve usage analytics for the Prisma Access Browser. Uses the Browser Management API (/browser-mgmt/v1/...).

Operation	Name	Description
`getUsage`	Get Usage Report	Retrieve a usage report for a specified date range

Key parameters:

start_date (required) — report start date in YYYY-MM-DD format
end_date (required) — report end date in YYYY-MM-DD format
granularity (optional) — aggregation period: daily, weekly, or monthly

Report data includes: active users, total sessions, data transferred, threats blocked, and DLP events for the requested period.

API Behaviour Notes

No Query Parameters on List Endpoints

The Prisma Access Browser SEB API rejects all query parameters on list operations with HTTP 400. This is by design:

Do not pass pageSize, page, limit, filter, or any other query params to list calls.
All filtering, sorting, and pagination must be applied to the response data in downstream workflow nodes.

Pagination Envelope

All list responses use the following envelope format:

{
  "pageInfo": {
    "hasNextPage": false,
    "cursor": ""
  },
  "data": [...]
}

(Some endpoints may use items or value as the data key. The connector normalises these automatically.)

Empty Body on POST/PUT/PATCH

All POST, PUT, and PATCH requests require a JSON body. Sending a request with no body causes HTTP 411 (Length Required). The connector always sends at minimum {} as the request body.

204 No Content Responses

DELETE operations and some action endpoints return HTTP 204 with no response body. The connector normalises these to:

{"success": true}

Check for the success key in downstream nodes rather than parsing a full response object.

409 Conflict on configManagement.publish

When configManagement.publish returns HTTP 409 with {"message": "No pending changes found"}, this means the active configuration is already current — there are no staged changes to publish. This is not an error condition; handle it as a success branch in your workflow.

Parameter Merging and Templating

The Prisma Access Browser integration uses NINA's parameter merging and templating capabilities:

Parameter Sources (in order of precedence)

Node Parameters: Parameters configured directly in the PAB Integration Node
Extracted Parameters: Parameters automatically extracted from upstream node output
Input Data: The complete input data from upstream nodes

Template variables within parameters are processed using {{variable_name}} syntax. All sources are merged before execution, with node parameters taking precedence.

Path Parameter Injection

Path parameters (e.g., {id}, {deviceGroupId}, {policy_id}, {deployment_id}) are automatically substituted from the merged parameter set. Ensure the parameter name matches exactly:

Resource	Path Parameter Name
User	`id`
Device	`id`
Device Group	`deviceGroupId`
User Group	`id`
Application	`id`, `type`
Application Group	`id`
Plugin	`id`
User Request	`id`
Policy	`policy_id`
Deployment	`deployment_id`

Example: User Management

Listing All Enrolled Users

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "user",
  "operation": "list",
  "parameters": {}
}

Getting a Specific User

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "user",
  "operation": "get",
  "parameters": {
    "id": "{{user_id}}"
  }
}

Suspending a User

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "user",
  "operation": "suspend",
  "parameters": {
    "id": "{{user_id}}"
  }
}

Forcing Re-authentication on a User

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "user",
  "operation": "forceReauth",
  "parameters": {
    "id": "{{user_id}}"
  }
}

Example: Device Management

Listing All Managed Devices

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "device",
  "operation": "list",
  "parameters": {}
}

Suspending Multiple Devices

Input Data from Previous Node:

{
  "compromised_devices": ["DEV001", "DEV002", "DEV003"]
}

Node Configuration:

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "device",
  "operation": "suspend",
  "parameters": {
    "deviceIds": "{{compromised_devices}}"
  }
}

Archiving and Deleting a Device

First archive:

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "device",
  "operation": "archive",
  "parameters": {
    "deviceIds": ["{{device_id}}"]
  }
}

Then restore before deletion (if needed):

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "device",
  "operation": "resume",
  "parameters": {
    "deviceIds": ["{{device_id}}"]
  }
}

Then delete permanently:

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "device",
  "operation": "delete",
  "parameters": {
    "deviceIds": ["{{device_id}}"]
  }
}

Example: Group Management

Creating a Device Group with Static Members

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "deviceGroup",
  "operation": "create",
  "parameters": {
    "name": "Finance Department Devices",
    "description": "All devices used by the Finance team",
    "deviceIds": ["{{device_id_1}}", "{{device_id_2}}"]
  }
}

Patching a Device Group

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "deviceGroup",
  "operation": "patch",
  "parameters": {
    "deviceGroupId": "{{group_id}}",
    "description": "Updated description for Finance devices"
  }
}

Creating a User Group

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "userGroup",
  "operation": "create",
  "parameters": {
    "name": "Executive Users",
    "description": "C-suite and VP-level users requiring elevated browser controls",
    "userIds": ["{{user_id_1}}", "{{user_id_2}}"]
  }
}

Example: Application Management

Listing All Applications

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "application",
  "operation": "list",
  "parameters": {}
}

Creating a New Web Application

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "application",
  "operation": "create",
  "parameters": {
    "type": "web",
    "name": "Corporate Intranet",
    "description": "Internal web portal"
  }
}

Patching an Application

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "application",
  "operation": "patch",
  "parameters": {
    "type": "web",
    "id": "{{app_id}}",
    "description": "Updated description for the corporate intranet"
  }
}

Bulk Deleting Applications

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "application",
  "operation": "bulkDelete",
  "parameters": {
    "applicationIds": ["{{app_id_1}}", "{{app_id_2}}", "{{app_id_3}}"]
  }
}

Creating an Application Group

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "applicationGroup",
  "operation": "create",
  "parameters": {
    "name": "Productivity Suite",
    "description": "Collaboration and productivity SaaS applications",
    "applicationIds": ["{{app_id_1}}", "{{app_id_2}}"]
  }
}

Example: Plugin Management

Listing All Plugins

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "plugin",
  "operation": "list",
  "parameters": {}
}

Creating a Plugin for an Application

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "plugin",
  "operation": "create",
  "parameters": {
    "id": "{{app_id}}",
    "name": "content-inspection",
    "config": {
      "enabled": true,
      "mode": "passive"
    }
  }
}

Deleting a Plugin

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "plugin",
  "operation": "delete",
  "parameters": {
    "id": "{{app_id}}"
  }
}

Example: User Request Handling

Listing Pending User Requests

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "userRequest",
  "operation": "list",
  "parameters": {}
}

Approving a User Request

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "userRequest",
  "operation": "action",
  "parameters": {
    "id": "{{request_id}}",
    "action": "approve",
    "reason": "Approved by security team after review"
  }
}

Denying a User Request

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "userRequest",
  "operation": "action",
  "parameters": {
    "id": "{{request_id}}",
    "action": "deny",
    "reason": "Extension not on approved list"
  }
}

Revoking a Previously Approved Request

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "userRequest",
  "operation": "revoke",
  "parameters": {
    "id": "{{request_id}}",
    "reason": "Access no longer required after role change"
  }
}

Example: Policy and Deployment Management

Creating a Browser Security Policy

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "policy",
  "operation": "create",
  "parameters": {
    "name": "Standard Employee Policy",
    "description": "Default browser security policy for all standard users",
    "enabled": true,
    "web_filtering": {
      "enabled": true,
      "blocked_categories": ["gambling", "adult-content", "malware"]
    },
    "dlp_enabled": true,
    "extension_policy": "allow_list",
    "download_control": "scan"
  }
}

Updating a Policy

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "policy",
  "operation": "update",
  "parameters": {
    "policy_id": "{{policy_id}}",
    "name": "Standard Employee Policy — v2",
    "enabled": true,
    "dlp_enabled": true,
    "extension_policy": "allow_list",
    "download_control": "block"
  }
}

Creating a Deployment for Windows

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "deployment",
  "operation": "create",
  "parameters": {
    "name": "Windows Managed Devices — Production",
    "platform": "windows",
    "description": "Production deployment for all Windows endpoints",
    "policy_id": "{{policy_id}}",
    "update_channel": "stable"
  }
}

Deleting a Policy

Note: Ensure the policy is not assigned to any active deployment before deleting.

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "policy",
  "operation": "delete",
  "parameters": {
    "policy_id": "{{policy_id}}"
  }
}

Example: Configuration Management

Publishing the Draft Configuration

After making changes (creating/updating policies, deployments, applications), publish the draft to activate them:

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "configManagement",
  "operation": "publish",
  "parameters": {}
}

Handle the 409 case in your workflow — it means no changes are pending and is not a failure:

If the operation returns a 409 response with No pending changes found, treat this as a no-op success branch rather than an error.

Example: Reports

Fetching a Monthly Usage Report

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "report",
  "operation": "getUsage",
  "parameters": {
    "start_date": "2026-06-01",
    "end_date": "2026-06-30",
    "granularity": "daily"
  }
}

Fetching a Weekly Usage Report with Template Variables

Input Data:

{
  "report_start": "2026-07-01",
  "report_end": "2026-07-07"
}

Node Configuration:

{
  "integration_service": "paloalto-prisma-access-browser",
  "resource": "report",
  "operation": "getUsage",
  "parameters": {
    "start_date": "{{report_start}}",
    "end_date": "{{report_end}}",
    "granularity": "weekly"
  }
}

Common Workflow Patterns

Incident Response — Suspend Compromised User and Devices

user.list — retrieve the user account by identity
user.suspend — immediately suspend browser access
device.list — retrieve devices associated with the user
device.suspend — suspend all associated devices
user.forceReauth — force re-authentication when access is restored
configManagement.publish — publish the updated state

Onboarding — Create Policy and Deployment for a New Team

policy.create — create a tailored browser security policy for the team
deployment.create — create a platform-specific deployment linked to the policy
deviceGroup.create — create a device group for the team's devices
userGroup.create — create a user group for the team's members
configManagement.publish — publish all changes to activate them

Access Request Triage

userRequest.list — retrieve all pending user requests
For each request: evaluate the request type and requester identity
userRequest.action with action: approve — approve legitimate requests
userRequest.action with action: deny — deny requests outside policy
configManagement.publish — publish the approved changes

Bulk Application Cleanup

application.list — retrieve all applications
Filter downstream for stale or decommissioned applications
application.bulkDelete — remove multiple applications in a single call
configManagement.publish — publish the removal to the active configuration

Usage Reporting

report.getUsage with the desired date range — retrieve the usage report
Parse data.activeUsers, data.sessions, data.threatsBlocked, data.dlpEvents
Forward to a downstream notification or SIEM node

Troubleshooting

Issue	Resolution
`401 Unauthorized` on all requests	Verify that Client ID, Client Secret, and Tenant ID are correct. Confirm the service account is active and not expired in SCM.
`403 Forbidden` on mutating operations	The service account role is likely View-Only Administrator. Assign the Super User role in SCM for write access.
`404 Not Found` on policy, deployment, or report operations	The Browser Management API may not be enabled on your tenant. Contact Palo Alto Networks support to verify the `browser-mgmt` entitlement.
`400 Bad Request` with `invalid value` on `application.listByType`	The type parameter enumeration may differ on your tenant. Use `application.list` and filter by type in the downstream workflow node.
`409 Conflict` on `configManagement.publish` with `No pending changes found`	This is not an error — the active configuration is already current. Treat as a no-op success in your workflow.
`501 Not Implemented` on `configManagement.publish`	Draft mode is not supported on this tenant. Changes may be applied directly without publishing.
`404 Not Found` on `plugin.getByApplication`	The specified application has no plugin configured. This is expected when querying applications that have not had a plugin attached.
`400 Bad Request` with `unknown query parameter` on list calls	List endpoints accept no query parameters. Remove all filter, page, or limit parameters from list operation calls.
`411 Length Required` on POST/PUT/PATCH	The request body is missing. Always pass at minimum `{}` for operations that have no required body parameters.
Suspended devices cannot be deleted	Resume the devices first with `device.resume`, then call `device.delete`.
Policy deletion returns error	Unassign the policy from all deployments before attempting deletion.
`deviceIds` validation error	The `deviceIds` parameter must be a non-empty array. Ensure at least one device ID is provided for all bulk device operations.
`applicationIds` validation error on `bulkDelete`	The `applicationIds` parameter must be a non-empty array. Ensure at least one application ID is provided.
Token refresh issues	The connector caches OAuth tokens and refreshes them automatically. If persistent 401 errors occur, delete and recreate the credential in NINA.
`prisma-tenant` header missing	This header is derived from the Tenant ID credential field and is sent automatically. Verify the Tenant ID is the correct TSG ID for your tenant.

Best Practices

Use a dedicated service account: Create a named service account in SCM specifically for NINA integration (e.g., NINA-PAB-Integration). Do not share credentials with other systems or users.
Apply the minimum required role: Use View-Only Administrator for read-only workflows (auditing, reporting, monitoring). Only assign Super User when the workflow needs to create, update, delete, or publish configurations.
Always publish after mutating changes: Changes to policies, deployments, applications, and groups are staged as a draft and are not effective until configManagement.publish is called. Include a publish step at the end of any workflow that modifies configuration.
Handle 409 on publish gracefully: If a workflow triggers configManagement.publish and receives 409 No pending changes found, this is a valid state — the active configuration already reflects the desired state. Route this as a success branch rather than a failure.
Do not pass query parameters to list endpoints: The SEB API rejects any unknown query parameter on list operations with HTTP 400. Retrieve the full list and apply filtering downstream in your workflow using NINA's data transformation capabilities.
Resume devices before deleting: The API rejects delete requests for suspended devices. Add a device.resume step before device.delete if the device lifecycle state is uncertain.
Unassign policies before deleting them: Deleting a policy that is still assigned to an active deployment will fail. Add a deployment.update step to clear the policy_id before calling policy.delete.
Use bulk operations for efficiency: device.archive, device.suspend, device.resume, device.delete, device.forceReauth, and application.bulkDelete all accept arrays. Batch device IDs into a single call rather than making per-device requests.
Keep the Client Secret secure: Store credentials exclusively through NINA's credential manager. Never include Client IDs or secrets in workflow parameters, logs, or comments. If a secret is exposed, delete the service account in SCM immediately and create a new one.
Rotate Client Secrets proactively: SASE service account secrets may have expiration policies. Monitor expiry dates and update the NINA credential before expiry to avoid workflow failures.
Validate TSG Tenant IDs carefully: The prisma-tenant header is critical for tenant scoping. An incorrect Tenant ID causes 401 Unauthorized or 403 Forbidden errors and can route API calls to the wrong tenant.
Check Browser Management API availability: The policy, deployment, and report resources use the Browser Management API endpoint (/browser-mgmt/v1/...). This endpoint is not available on all tenants or in all regions. Verify availability before building workflows that depend on these resources.
Use template variables for dynamic workflows: Use {{variable_name}} syntax to pass user IDs, device IDs, policy IDs, and other values from upstream nodes dynamically.
Test credentials before production use: Use the Test Connection button when creating credentials. It acquires an OAuth token from the Palo Alto identity platform and fails fast if the credentials are incorrect — before any workflow runs.

Security Considerations

Protect Client Secrets: Store credentials exclusively through NINA's credential manager. Never log, expose in workflow configurations, or include in comments the Client ID or Client Secret values.
Review service account permissions regularly: Periodically audit active service accounts in SCM and remove accounts that are no longer in use. An unused Super User service account is an unnecessary attack surface.
Audit publish operations: configManagement.publish activates all pending configuration changes across the entire tenant. Implement workflow-level approval gates before publish steps in production environments to prevent accidental or unauthorized policy changes.
Limit blast radius with purpose-built accounts: If you have multiple NINA workflows with different purposes (read-only auditing, policy management, user management), consider separate service accounts per workflow category. This limits the impact if one credential is compromised.
Monitor for unexpected suspensions or deletions: Device and user suspension operations have immediate operational impact. Ensure that workflows calling device.suspend, user.suspend, or device.delete include explicit confirmation logic or are gated behind approval steps.
Treat Tenant ID as a sensitive value: The TSG Tenant ID scopes all API calls to your organisation's tenant. While not a secret in the cryptographic sense, exposing it can reveal organisational metadata. Store it in the credential rather than in workflow parameter fields.

Updated: 2026-07-03

Overview​

Status​

Credential Configuration​

Authentication Method​

OAuth2 Client Credentials​

How to Create a SASE Service Account and API Client​

Required Roles and Permissions​

Dual API Base URL Routing​

Creating a Prisma Access Browser Credential​

Supported Resources and Operations​

User​

Device​

Device Group​

User Group​

Application​

Application Group​

Plugin​

User Request​

Configuration Management​

Policy​

Deployment​

Report​

API Behaviour Notes​

No Query Parameters on List Endpoints​

Pagination Envelope​

Empty Body on POST/PUT/PATCH​

204 No Content Responses​

409 Conflict on configManagement.publish​

Parameter Merging and Templating​

Parameter Sources (in order of precedence)​

Path Parameter Injection​

Example: User Management​

Listing All Enrolled Users​

Getting a Specific User​

Suspending a User​

Forcing Re-authentication on a User​

Example: Device Management​

Listing All Managed Devices​

Suspending Multiple Devices​

Input Data from Previous Node:​

Node Configuration:​

Archiving and Deleting a Device​

Example: Group Management​

Creating a Device Group with Static Members​

Patching a Device Group​

Creating a User Group​

Example: Application Management​

Listing All Applications​

Creating a New Web Application​

Patching an Application​

Bulk Deleting Applications​

Creating an Application Group​

Example: Plugin Management​

Listing All Plugins​

Creating a Plugin for an Application​

Deleting a Plugin​

Example: User Request Handling​

Listing Pending User Requests​

Approving a User Request​

Denying a User Request​

Revoking a Previously Approved Request​

Example: Policy and Deployment Management​

Creating a Browser Security Policy​

Updating a Policy​

Creating a Deployment for Windows​

Deleting a Policy​

Example: Configuration Management​

Publishing the Draft Configuration​

Example: Reports​

Fetching a Monthly Usage Report​

Fetching a Weekly Usage Report with Template Variables​

Input Data:​

Node Configuration:​

Common Workflow Patterns​

Incident Response — Suspend Compromised User and Devices​

Onboarding — Create Policy and Deployment for a New Team​

Access Request Triage​

Bulk Application Cleanup​

Usage Reporting​

Troubleshooting​

Overview

Status

Credential Configuration

Authentication Method

OAuth2 Client Credentials

How to Create a SASE Service Account and API Client

Required Roles and Permissions

Dual API Base URL Routing

Creating a Prisma Access Browser Credential

Supported Resources and Operations

User

Device

Device Group

User Group

Application

Application Group

Plugin

User Request

Configuration Management

Policy

Deployment

Report

API Behaviour Notes

No Query Parameters on List Endpoints

Pagination Envelope

Empty Body on POST/PUT/PATCH

204 No Content Responses

409 Conflict on configManagement.publish

Parameter Merging and Templating

Parameter Sources (in order of precedence)

Path Parameter Injection

Example: User Management

Listing All Enrolled Users

Getting a Specific User

Suspending a User

Forcing Re-authentication on a User

Example: Device Management

Listing All Managed Devices

Suspending Multiple Devices

Input Data from Previous Node:

Node Configuration:

Archiving and Deleting a Device

Example: Group Management

Creating a Device Group with Static Members

Patching a Device Group

Creating a User Group

Example: Application Management

Listing All Applications

Creating a New Web Application

Patching an Application

Bulk Deleting Applications

Creating an Application Group

Example: Plugin Management

Listing All Plugins

Creating a Plugin for an Application

Deleting a Plugin

Example: User Request Handling

Listing Pending User Requests

Approving a User Request

Denying a User Request

Revoking a Previously Approved Request

Example: Policy and Deployment Management

Creating a Browser Security Policy

Updating a Policy

Creating a Deployment for Windows

Deleting a Policy

Example: Configuration Management

Publishing the Draft Configuration

Example: Reports

Fetching a Monthly Usage Report

Fetching a Weekly Usage Report with Template Variables

Input Data:

Node Configuration:

Common Workflow Patterns

Incident Response — Suspend Compromised User and Devices

Onboarding — Create Policy and Deployment for a New Team

Access Request Triage

Bulk Application Cleanup

Usage Reporting

Troubleshooting