Skip to main content

Next-Gen Trust Security overview

Next-Gen Trust Security (NGTS) is Palo Alto Networks' machine identity management service, delivered on Strata Cloud Manager (SCM). It helps you discover, monitor, and automate the lifecycle of your TLS keys and certificates so you can prevent outages and enforce consistent policy across the data center, the cloud, and everywhere in between.

This section is the developer guide for working with NGTS through its REST API. Anything you can do in the NGTS web interface, you can automate with the API.

What you can do with the NGTS API​

  • Discover and inventory TLS certificates and keys across your environments
  • Request, renew, revoke, and retire certificates against issuing templates
  • Automate certificate installation to cloud keystores and machines
  • Organize and scope certificates with tags and Tenant Service Groups (TSGs)
  • Monitor expirations and forward notifications into your own systems

Key concepts​

NGTS runs on Strata Cloud Manager, so a few platform concepts shape how the API works:

  • Tenant Service Groups (TSGs) — the unit of ownership and access scoping. Resources you create are owned by the TSG that made the request.
  • Roles — a caller's effective permissions are the intersection of its TSG and its assigned role.
  • Tags — used to group and label certificates. NGTS does not have the "Applications" concept from Certificate Manager SaaS; use tags instead.
  • Service accounts and built-in accounts — machine identities used for API authentication. NGTS does not use user API keys.
Product documentation

For conceptual and web-interface documentation, see the Next-Gen Trust Security product docs.

Where to start​

  • New to the NGTS API? Start with the Getting started guide to authenticate and make your first request.
  • Looking for a specific endpoint? Browse the NGTS API reference.
  • Automating a common task? The guides in this section walk through tasks such as importing private keys, downloading keystores, and setting up expiration notifications.