Skip to main content

Getting started with the NGTS API

This guide walks you through authenticating to the Next-Gen Trust Security (NGTS) REST API and making your first request.

Prerequisites​

Before you begin, you need:

  • Access to Next-Gen Trust Security on Palo Alto Networks Strata Cloud Manager (SCM).
  • A Tenant Service Group (TSG) to operate in, and its TSG ID.
  • A service account or built-in account with a role that grants the permissions you need. NGTS does not use user API keys — API callers authenticate with machine accounts. See Built-in Accounts in the product docs.
note

Your effective permissions are the intersection of the TSG you operate in and the role assigned to your account. Resources you create are owned by that TSG.

Base URL​

All NGTS API requests go through the Strata Cloud Manager API gateway:

https://api.strata.paloaltonetworks.com/ngts

Step 1: Authenticate​

NGTS APIs use the OAuth 2.0 Client Credentials flow. Using the client_id and client_secret from your service account, request an access token from the Strata Cloud Manager token endpoint with a scope of tsg_id:<your-TSG-ID>:

curl --request POST \
  --url 'https://auth.apps.paloaltonetworks.com/oauth2/access_token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --user '<client_id>:<client_secret>' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'scope=tsg_id:<your-TSG-ID>'

The request returns a JWT access token:

{
  "access_token": "<access_token>",
  "token_type": "Bearer",
  "expires_in": 899
}

Attach the token to every API call as a Bearer token:

Authorization: Bearer <access_token>

For an interactive authentication walkthrough, see the NGTS API reference.

Step 2: Make your first request​

With your access token, call an NGTS endpoint. For example, list the certificate issuing templates available in your TSG:

curl --request GET \
  --url 'https://api.strata.paloaltonetworks.com/ngts/v1/certificateissuingtemplates' \
  --header 'Authorization: Bearer <access_token>'

The API reference lists every endpoint with its request parameters and response schemas, and lets you try calls interactively.

Coming from Certificate Manager SaaS?​

If you're migrating from Certificate Manager SaaS (CM SaaS), the biggest differences are:

  • Authentication uses Strata/NGTS machine accounts instead of CM SaaS service accounts or user API keys.
  • The "Applications" feature has been removed. Use tags to group certificates and TSGs for ownership and access scoping.
  • A single API endpoint (the Strata gateway) replaces CM SaaS's regional endpoints.

Technology partners porting an existing integration should also read Adding NGTS Support to Your Integration.

Next steps​

  • Work through the task guides in this section (importing private keys, downloading keystores, expiration notifications, and more).
  • Browse the full NGTS API reference.
  • Read the NGTS product documentation for concepts and web-interface workflows.