Palo Alto Networks · Capability

Incident Security Service Posture Management API — IDP

Incident Security Service Posture Management API — IDP. 11 operations. Lead operation: Palo Alto Networks Get All Identity Providers. Self-contained Naftiko capability covering one Palo Alto Networks business surface.

Run with Naftiko Palo Alto NetworksIDP

What You Can Do

GET
Idpsget — Palo Alto Networks Get All Identity Providers
/v1/sspm/identity/v1/idps
POST
Idpspost — Palo Alto Networks Create Identity Provider
/v1/sspm/identity/v1/idps
GET
Idpsaccountslogoutget — Palo Alto Networks Get Logout Status
/v1/sspm/identity/v1/idps/{idpid}/accounts/logout
POST
Idpsaccountslogoutpost — Palo Alto Networks Trigger Account Logout
/v1/sspm/identity/v1/idps/{idpid}/accounts/logout
GET
Idpsfeaturestateget — Palo Alto Networks Get Identity Provider Feature State
/v1/sspm/identity/v1/idps/{idpid}/feature-state
GET
Idpsidpaccountscountget — Palo Alto Networks Get Identity Provider Account Count
/v1/sspm/identity/v1/idps/{idpid}/idp-accounts/count
POST
Idpsidpaccountscsvreportget — Palo Alto Networks Generate Identity Provider Account CSV Report
/v1/sspm/identity/v1/idps/{idpid}/idp-accounts/csv-report
GET
Idpsmfaactivityget — Palo Alto Networks Get Multi-factor Authentication Activity Logs
/v1/sspm/identity/v1/idps/{idpid}/mfa-activity
GET
Idpsmfaactivitycountget — Palo Alto Networks Get Multi-factor Authentication Activity Count
/v1/sspm/identity/v1/idps/{idpid}/mfa-activity/count
GET
Idpsmfaactivitycountbyapptypeget — Palo Alto Networks Get Multi-factor Authentication Activity Count by App Type
/v1/sspm/identity/v1/idps/{idpid}/mfa-activity/count-by-app-type
POST
Idpsmfaactivitycsvreportget — Palo Alto Networks Generate Identity Provider Multi-factor Authentication Activity CSV Report
/v1/sspm/identity/v1/idps/{idpid}/mfa-activity/csv-report

MCP Tools

palo-alto-networks-get-all

Palo Alto Networks Get All Identity Providers

read-only idempotent
palo-alto-networks-create-identity

Palo Alto Networks Create Identity Provider

palo-alto-networks-get-logout

Palo Alto Networks Get Logout Status

read-only idempotent
palo-alto-networks-trigger-account

Palo Alto Networks Trigger Account Logout

palo-alto-networks-get-identity

Palo Alto Networks Get Identity Provider Feature State

read-only idempotent
palo-alto-networks-get-identity-2

Palo Alto Networks Get Identity Provider Account Count

read-only idempotent
palo-alto-networks-generate-identity

Palo Alto Networks Generate Identity Provider Account CSV Report

palo-alto-networks-get-multi

Palo Alto Networks Get Multi-factor Authentication Activity Logs

read-only idempotent
palo-alto-networks-get-multi-2

Palo Alto Networks Get Multi-factor Authentication Activity Count

read-only idempotent
palo-alto-networks-get-multi-3

Palo Alto Networks Get Multi-factor Authentication Activity Count by App Type

read-only idempotent
palo-alto-networks-generate-identity-2

Palo Alto Networks Generate Identity Provider Multi-factor Authentication Activity CSV Report

Capability Spec

palo-alto-identity-security-posture-management-idp.yaml Raw ↑ 
naftiko: 1.0.0-alpha2
info:
  label: Incident Security Service Posture Management API — IDP
  description: 'Incident Security Service Posture Management API — IDP. 11 operations. Lead operation: Palo Alto Networks
    Get All Identity Providers. Self-contained Naftiko capability covering one Palo Alto Networks business surface.'
  tags:
  - Palo Alto Networks
  - IDP
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    PALO_ALTO_NETWORKS_API_KEY: PALO_ALTO_NETWORKS_API_KEY
capability:
  consumes:
  - type: http
    namespace: palo-alto-identity-security-posture-management-idp
    baseUri: https://api.sase.paloaltonetworks.com
    description: Incident Security Service Posture Management API — IDP business capability. Self-contained, no shared references.
    resources:
    - name: sspm-identity-v1-idps
      path: /sspm/identity/v1/idps
      operations:
      - name: idpsget
        method: GET
        description: Palo Alto Networks Get All Identity Providers
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: designated
          in: query
          type: boolean
        - name: x-ps-tenant
          in: header
          type: string
      - name: idpspost
        method: POST
        description: Palo Alto Networks Create Identity Provider
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: designated
          in: query
          type: boolean
        - name: idpId
          in: query
          type: string
        - name: idpType
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-idps-idpId-accounts-logout
      path: /sspm/identity/v1/idps/{idpId}/accounts/logout
      operations:
      - name: idpsaccountslogoutget
        method: GET
        description: Palo Alto Networks Get Logout Status
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: idpId
          in: path
          type: string
          required: true
        - name: batch_id
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
      - name: idpsaccountslogoutpost
        method: POST
        description: Palo Alto Networks Trigger Account Logout
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: idpId
          in: path
          type: string
          required: true
        - name: x-ps-tenant
          in: header
          type: string
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: sspm-identity-v1-idps-idpId-feature_state
      path: /sspm/identity/v1/idps/{idpId}/feature_state
      operations:
      - name: idpsfeaturestateget
        method: GET
        description: Palo Alto Networks Get Identity Provider Feature State
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: idpId
          in: path
          type: string
          required: true
        - name: feature
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-idps-idpId-idp_accounts-count
      path: /sspm/identity/v1/idps/{idpId}/idp_accounts/count
      operations:
      - name: idpsidpaccountscountget
        method: GET
        description: Palo Alto Networks Get Identity Provider Account Count
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: idpId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-idps-idpId-idp_accounts-csv_report
      path: /sspm/identity/v1/idps/{idpId}/idp_accounts/csv_report
      operations:
      - name: idpsidpaccountscsvreportget
        method: POST
        description: Palo Alto Networks Generate Identity Provider Account CSV Report
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: idpId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: sortBy
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: sspm-identity-v1-idps-idpId-mfa_activity
      path: /sspm/identity/v1/idps/{idpId}/mfa_activity
      operations:
      - name: idpsmfaactivityget
        method: GET
        description: Palo Alto Networks Get Multi-factor Authentication Activity Logs
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: idpId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: limit
          in: query
          type: integer
        - name: page
          in: query
          type: integer
        - name: sortBy
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-idps-idpId-mfa_activity-count
      path: /sspm/identity/v1/idps/{idpId}/mfa_activity/count
      operations:
      - name: idpsmfaactivitycountget
        method: GET
        description: Palo Alto Networks Get Multi-factor Authentication Activity Count
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: idpId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-idps-idpId-mfa_activity-count_by_app_type
      path: /sspm/identity/v1/idps/{idpId}/mfa_activity/count_by_app_type
      operations:
      - name: idpsmfaactivitycountbyapptypeget
        method: GET
        description: Palo Alto Networks Get Multi-factor Authentication Activity Count by App Type
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: idpId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: limit
          in: query
          type: integer
        - name: page
          in: query
          type: integer
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-idps-idpId-mfa_activity-csv_report
      path: /sspm/identity/v1/idps/{idpId}/mfa_activity/csv_report
      operations:
      - name: idpsmfaactivitycsvreportget
        method: POST
        description: Palo Alto Networks Generate Identity Provider Multi-factor Authentication Activity CSV Report
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: idpId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: sortBy
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
  exposes:
  - type: rest
    namespace: palo-alto-identity-security-posture-management-idp-rest
    port: 8080
    description: REST adapter for Incident Security Service Posture Management API — IDP. One Spectral-compliant resource
      per consumed operation, prefixed with /v1.
    resources:
    - path: /v1/sspm/identity/v1/idps
      name: sspm-identity-v1-idps
      description: REST surface for sspm-identity-v1-idps.
      operations:
      - method: GET
        name: idpsget
        description: Palo Alto Networks Get All Identity Providers
        call: palo-alto-identity-security-posture-management-idp.idpsget
        with:
          designated: rest.designated
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: idpspost
        description: Palo Alto Networks Create Identity Provider
        call: palo-alto-identity-security-posture-management-idp.idpspost
        with:
          designated: rest.designated
          idpId: rest.idpId
          idpType: rest.idpType
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/idps/{idpid}/accounts/logout
      name: sspm-identity-v1-idps-idpid-accounts-logout
      description: REST surface for sspm-identity-v1-idps-idpId-accounts-logout.
      operations:
      - method: GET
        name: idpsaccountslogoutget
        description: Palo Alto Networks Get Logout Status
        call: palo-alto-identity-security-posture-management-idp.idpsaccountslogoutget
        with:
          idpId: rest.idpId
          batch_id: rest.batch_id
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: idpsaccountslogoutpost
        description: Palo Alto Networks Trigger Account Logout
        call: palo-alto-identity-security-posture-management-idp.idpsaccountslogoutpost
        with:
          idpId: rest.idpId
          x-ps-tenant: rest.x-ps-tenant
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/idps/{idpid}/feature-state
      name: sspm-identity-v1-idps-idpid-feature-state
      description: REST surface for sspm-identity-v1-idps-idpId-feature_state.
      operations:
      - method: GET
        name: idpsfeaturestateget
        description: Palo Alto Networks Get Identity Provider Feature State
        call: palo-alto-identity-security-posture-management-idp.idpsfeaturestateget
        with:
          idpId: rest.idpId
          feature: rest.feature
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/idps/{idpid}/idp-accounts/count
      name: sspm-identity-v1-idps-idpid-idp-accounts-count
      description: REST surface for sspm-identity-v1-idps-idpId-idp_accounts-count.
      operations:
      - method: GET
        name: idpsidpaccountscountget
        description: Palo Alto Networks Get Identity Provider Account Count
        call: palo-alto-identity-security-posture-management-idp.idpsidpaccountscountget
        with:
          idpId: rest.idpId
          filter: rest.filter
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/idps/{idpid}/idp-accounts/csv-report
      name: sspm-identity-v1-idps-idpid-idp-accounts-csv-report
      description: REST surface for sspm-identity-v1-idps-idpId-idp_accounts-csv_report.
      operations:
      - method: POST
        name: idpsidpaccountscsvreportget
        description: Palo Alto Networks Generate Identity Provider Account CSV Report
        call: palo-alto-identity-security-posture-management-idp.idpsidpaccountscsvreportget
        with:
          idpId: rest.idpId
          filter: rest.filter
          sortBy: rest.sortBy
          x-ps-tenant: rest.x-ps-tenant
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/idps/{idpid}/mfa-activity
      name: sspm-identity-v1-idps-idpid-mfa-activity
      description: REST surface for sspm-identity-v1-idps-idpId-mfa_activity.
      operations:
      - method: GET
        name: idpsmfaactivityget
        description: Palo Alto Networks Get Multi-factor Authentication Activity Logs
        call: palo-alto-identity-security-posture-management-idp.idpsmfaactivityget
        with:
          idpId: rest.idpId
          filter: rest.filter
          limit: rest.limit
          page: rest.page
          sortBy: rest.sortBy
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/idps/{idpid}/mfa-activity/count
      name: sspm-identity-v1-idps-idpid-mfa-activity-count
      description: REST surface for sspm-identity-v1-idps-idpId-mfa_activity-count.
      operations:
      - method: GET
        name: idpsmfaactivitycountget
        description: Palo Alto Networks Get Multi-factor Authentication Activity Count
        call: palo-alto-identity-security-posture-management-idp.idpsmfaactivitycountget
        with:
          idpId: rest.idpId
          filter: rest.filter
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/idps/{idpid}/mfa-activity/count-by-app-type
      name: sspm-identity-v1-idps-idpid-mfa-activity-count-by-app-type
      description: REST surface for sspm-identity-v1-idps-idpId-mfa_activity-count_by_app_type.
      operations:
      - method: GET
        name: idpsmfaactivitycountbyapptypeget
        description: Palo Alto Networks Get Multi-factor Authentication Activity Count by App Type
        call: palo-alto-identity-security-posture-management-idp.idpsmfaactivitycountbyapptypeget
        with:
          idpId: rest.idpId
          filter: rest.filter
          limit: rest.limit
          page: rest.page
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/idps/{idpid}/mfa-activity/csv-report
      name: sspm-identity-v1-idps-idpid-mfa-activity-csv-report
      description: REST surface for sspm-identity-v1-idps-idpId-mfa_activity-csv_report.
      operations:
      - method: POST
        name: idpsmfaactivitycsvreportget
        description: Palo Alto Networks Generate Identity Provider Multi-factor Authentication Activity CSV Report
        call: palo-alto-identity-security-posture-management-idp.idpsmfaactivitycsvreportget
        with:
          idpId: rest.idpId
          filter: rest.filter
          sortBy: rest.sortBy
          x-ps-tenant: rest.x-ps-tenant
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: palo-alto-identity-security-posture-management-idp-mcp
    port: 9090
    transport: http
    description: MCP adapter for Incident Security Service Posture Management API — IDP. One tool per consumed operation,
      routed inline through this capability's consumes block.
    tools:
    - name: palo-alto-networks-get-all
      description: Palo Alto Networks Get All Identity Providers
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-idp.idpsget
      with:
        designated: tools.designated
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-create-identity
      description: Palo Alto Networks Create Identity Provider
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: palo-alto-identity-security-posture-management-idp.idpspost
      with:
        designated: tools.designated
        idpId: tools.idpId
        idpType: tools.idpType
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-logout
      description: Palo Alto Networks Get Logout Status
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-idp.idpsaccountslogoutget
      with:
        idpId: tools.idpId
        batch_id: tools.batch_id
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-trigger-account
      description: Palo Alto Networks Trigger Account Logout
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: palo-alto-identity-security-posture-management-idp.idpsaccountslogoutpost
      with:
        idpId: tools.idpId
        x-ps-tenant: tools.x-ps-tenant
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-identity
      description: Palo Alto Networks Get Identity Provider Feature State
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-idp.idpsfeaturestateget
      with:
        idpId: tools.idpId
        feature: tools.feature
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-identity-2
      description: Palo Alto Networks Get Identity Provider Account Count
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-idp.idpsidpaccountscountget
      with:
        idpId: tools.idpId
        filter: tools.filter
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-generate-identity
      description: Palo Alto Networks Generate Identity Provider Account CSV Report
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: palo-alto-identity-security-posture-management-idp.idpsidpaccountscsvreportget
      with:
        idpId: tools.idpId
        filter: tools.filter
        sortBy: tools.sortBy
        x-ps-tenant: tools.x-ps-tenant
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-multi
      description: Palo Alto Networks Get Multi-factor Authentication Activity Logs
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-idp.idpsmfaactivityget
      with:
        idpId: tools.idpId
        filter: tools.filter
        limit: tools.limit
        page: tools.page
        sortBy: tools.sortBy
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-multi-2
      description: Palo Alto Networks Get Multi-factor Authentication Activity Count
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-idp.idpsmfaactivitycountget
      with:
        idpId: tools.idpId
        filter: tools.filter
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-multi-3
      description: Palo Alto Networks Get Multi-factor Authentication Activity Count by App Type
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-idp.idpsmfaactivitycountbyapptypeget
      with:
        idpId: tools.idpId
        filter: tools.filter
        limit: tools.limit
        page: tools.page
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-generate-identity-2
      description: Palo Alto Networks Generate Identity Provider Multi-factor Authentication Activity CSV Report
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: palo-alto-identity-security-posture-management-idp.idpsmfaactivitycsvreportget
      with:
        idpId: tools.idpId
        filter: tools.filter
        sortBy: tools.sortBy
        x-ps-tenant: tools.x-ps-tenant
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.