>
    Strata Copilot
    Run Operational Mode Commands (API)
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. PAN-OS XML API Request Types and Actions
    4. Run Operational Mode Commands (API)
    Download PDF
    Next-Generation Firewall

    Run Operational Mode Commands (API)

    Table of Contents

    Run Operational Mode Commands (API)

    Use any of the operational mode commands available on the command line interface with the following API request:
    curl -X POST 'https://firewall/api?type=op&cmd=<xml-body>"
    Use the API Browser to explore operational mode commands and a complete listing of all the options available for thexml-body and their corresponding operation.
    Some requests operational mode commands, including download, upgrade, and installation requests, are asynchronous, meaning they require more than one request to get final results. Learn more about Asynchronous and Synchronous Requests to the PAN-OS XML API.
    Operational Command
    API Request
    System restart.
    curl -X POST 'https://firewall/api?type=op&cmd=<request><restart><system></system></restart></request>"
    System software version installation.
    curl -X POST 'https://firewall/api?type=op&cmd=<request><system><software><install><version>version_number</version></install></software></system></request>"
    Multi-vsys mode.
    curl -X POST 'https://firewall/api?type=op&cmd=<set><system><setting><multi-vsys></multi-vsys></setting></system></set>"
    User Activity Report scheduling.
    curl -X POST 'https://firewall/api?type=op&cmd=<schedule><uar-report><user>username</user><title>titlename</title></uar-report></schedule>"
    Detailed information on applications and threats from the firewall.
    curl -X POST 'https://firewall/api?type=op&cmd=<show><predefined><xpath>/predefined/threats/vulnerability/entry[@name='30003']</xpath></predefined></show>"
    Full configuration validation.
    curl -X POST 'https://firewall/api?type=op&cmd=<validate><full></full></validate>"
    Partial configuration validation.
    curl -X POST 'https://firewall/api?type=op&cmd=<validate><partial><device-and-network>excluded</device-and-network></partial></validate>"
    Configuration saving.
    curl -X POST 'https://firewall/api?type=op&cmd=<save><config><to>filename</to></config></save>"
    Configuration loading.
    curl -X POST 'https://firewall/api?type=op&cmd=<load><config><from>filename</from></config></load>"
    Partial revert of admin-level changes for a candidate configuration on a firewall.
    curl -X POST 'https://firewall/api?type=op&cmd=<revert><config><partial><admin><member>admin-name</member></admin></partial></config></revert>"
    Partial revert of admin-level changes to Panorama by a specific administrator within a specific device group
    curl -X POST 'https://panorama/api?type=op&cmd=<revert><config><partial><admin><member><admin-name></member></admin><device-group><member><device-group-name></member></device-group><no-template/><no-template-stack/><no-log-collector-group/><no-log-collector/><device-and-network>excluded</device-and-network></partial></config></revert>"
    Base64-encoded metadata of a SAML authentication profile.
    curl -X POST 'https://firewall/api?type=op&cmd=<show><sp-metadata><management><authprofile><SAML-auth-profile-name></authprofile></management></sp-metadata></show>"
    Summary of changes between the active and candidate configuration.
    curl -X POST 'https://firewall/api?type=op&cmd=<show><config><list><change-summary/></list></config></show>"
    Commit locks
    curl -X POST 'https://firewall/api?type=op&cmd=<show><commit-locks/></show>"
    Remove configuration lock
    curl -X POST 'https://firewall/api?type=op&cmd=<request><config-lock><remove></remove><config-lock><remove></config-lock/></request>"
    To remove the configuration lock for a particular Device Group, append &vsys=TargetDG to the end of request where TargetDG is the name of the Device Group.
    Remove configuration locks for a particular template
    1. Change the target template using the following command: 
      curl -X POST 'https://firewall/api?type=op&cmd=<set><system><setting><target><template><name>Target-Template</name></template></target></setting></system></set>
    2. Issue the remove configuration lock command: 
      curl -X POST 'https://firewall/api?type=op&cmd=<request><config-lock><remove></remove></config-lock></request>
    Show WildFire appliances connected to Panorama.
    curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance><connected></connected></wildfire-appliance></show>"
    System summary about WildFire appliances or WildFire clusters.
    • WildFire Appliance:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance><all></all></wildfire-appliance></show>"
    • WildFire Cluster:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance-cluster><all></all></wildfire-appliance-cluster></show>"
    Generate a list of Firewalls connected and sending data to a WildFire appliance or WildFire cluster.
    • WildFire Appliance:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance><devices-reporting-data><serial-number><serial_number></serial-number></devices-reporting-data></wildfire-appliance></show>"
    • WildFire Cluster:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance-cluster><devices-reporting-data><name><cluster_name></name></devices-reporting-data></wildfire-appliance-cluster></show>"
    Display configuration details about a specified WildFire appliance or WildFire cluster.
    • WildFire Appliance:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance><info><serial-number><serial_number></serial-number></info></wildfire-appliance></show>"
    • WildFire Cluster:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance-cluster><info><name><cluster_name></name></info></wildfire-appliance-cluster></show>"
    Display registration activity for a specified WildFire appliance or WildFire cluster.
    • WildFire Appliance:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance><last-device-registration><all><serial-number><serial_number></serial-number></all></last-device-registration></wildfire-appliance></show>"
    • WildFire Cluster:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance-cluster><last-device-registration><all><name><cluster_name></name></all></last-device-registration></wildfire-appliance-cluster></show>"
    Display statistics for a specified WildFire appliance or WildFire cluster.
    • WildFire Appliance:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance><statistics><days><days_up_to_31></days><type><all_or_file_or_general></type><serial-number><serial_number></name></statistics></wildfire-appliance></show>"
    • WildFire Cluster:
      curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance-cluster><statistics><hours><hours_up_to_24></minutes><type><all_or_file_or_general></type><name><cluster_name></name></statistics></wildfire-appliance-cluster></show>"
    Display a list of supported VM images on the specified WildFire appliance.
    curl -X POST 'https://panorama/api?&type=op&cmd=<show><wildfire-appliance><vm-images><serial-number><serial_number></serial-number></vm-images></wildfire-appliance></show>"

    © 2026 Palo Alto Networks, Inc. All rights reserved.