Configuration
All SDK clients can be configured via constructor options or environment variables. Copy .env.example to .env to get started.
cp .env.example .env
Scan API
The Scan API is configured globally with init(). It requires either an API key or a pre-obtained bearer token.
| Env Var | Required | Default |
|---|---|---|
PANW_AI_SEC_API_KEY | One of key/token | — |
PANW_AI_SEC_API_TOKEN | One of key/token | — |
PANW_AI_SEC_API_ENDPOINT | No | https://service.api.aisecurity.paloaltonetworks.com |
import { AIRS_ENDPOINTS, init } from '@cdot65/prisma-airs-sdk';
init({
apiKey: process.env.PANW_AI_SEC_API_KEY,
apiEndpoint: AIRS_ENDPOINTS.EU,
numRetries: 3,
});
numRetries is supported by all SDK clients, accepts values from 0 to 5, and defaults to 5.
Every Scanner method also accepts a per-call override. This is useful for giving an async POST one
fetch attempt while retaining bounded retries for idempotent polling GETs:
const receipt = await scanner.asyncScan(batch, { numRetries: 0 });
const rows = await scanner.queryByScanIds([receipt.scan_id], { numRetries: 2 });
Omitting the per-call option uses the global value. numRetries counts retries after the initial
attempt, so 0 means one total attempt and 5 permits six total attempts.
Management API
| Env Var | Required | Default |
|---|---|---|
PANW_MGMT_CLIENT_ID | Yes | — |
PANW_MGMT_CLIENT_SECRET | Yes | — |
PANW_MGMT_TSG_ID | Yes | — |
PANW_MGMT_ENDPOINT | No | https://api.sase.paloaltonetworks.com/aisec |
PANW_MGMT_TOKEN_ENDPOINT | No | https://auth.apps.paloaltonetworks.com/oauth2/access_token |
The DLP namespace (client.dlp) reuses these OAuth credentials. Its base URL defaults to https://api.dlp.paloaltonetworks.com and is overridden with the ManagementClient constructor, not an environment variable:
import { ManagementClient } from '@cdot65/prisma-airs-sdk';
const client = new ManagementClient({
dlpEndpoint: 'https://api.dlp.paloaltonetworks.com',
});
Model Security API
Falls back to PANW_MGMT_* variables if service-specific ones are not set.
| Env Var | Required | Default |
|---|---|---|
PANW_MODEL_SEC_CLIENT_ID | Falls back to MGMT | — |
PANW_MODEL_SEC_CLIENT_SECRET | Falls back to MGMT | — |
PANW_MODEL_SEC_TSG_ID | Falls back to MGMT | — |
PANW_MODEL_SEC_DATA_ENDPOINT | No | https://api.sase.paloaltonetworks.com/aims/data |
PANW_MODEL_SEC_MGMT_ENDPOINT | No | https://api.sase.paloaltonetworks.com/aims/mgmt |
PANW_MODEL_SEC_TOKEN_ENDPOINT | Falls back to MGMT | https://auth.apps.paloaltonetworks.com/oauth2/access_token |
Red Team API
Falls back to PANW_MGMT_* variables if service-specific ones are not set.
| Env Var | Required | Default |
|---|---|---|
PANW_RED_TEAM_CLIENT_ID | Falls back to MGMT | — |
PANW_RED_TEAM_CLIENT_SECRET | Falls back to MGMT | — |
PANW_RED_TEAM_TSG_ID | Falls back to MGMT | — |
PANW_RED_TEAM_DATA_ENDPOINT | No | https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane |
PANW_RED_TEAM_MGMT_ENDPOINT | No | https://api.sase.paloaltonetworks.com/ai-red-teaming/mgmt-plane |
PANW_RED_TEAM_NETWORK_BROKER_ENDPOINT | No | https://api.sase.paloaltonetworks.com/ai-red-teaming/data-plane/network-broker |
PANW_RED_TEAM_TOKEN_ENDPOINT | Falls back to MGMT | https://auth.apps.paloaltonetworks.com/oauth2/access_token |
AI Gateway API
Falls back to PANW_MGMT_* variables if service-specific ones are not set. PANW_AI_GW_TSG_ID is also sent as the x-tsg-id header on every request.
| Env Var | Required | Default |
|---|---|---|
PANW_AI_GW_CLIENT_ID | Falls back to MGMT | — |
PANW_AI_GW_CLIENT_SECRET | Falls back to MGMT | — |
PANW_AI_GW_TSG_ID | Falls back to MGMT | — |
PANW_AI_GW_DATA_ENDPOINT | No | https://api.apps.paloaltonetworks.com/ai_gw/v2 |
PANW_AI_GW_ADMIN_ENDPOINT | No | https://api.apps.paloaltonetworks.com/ai_gw/admin/v2 |
PANW_AI_GW_TOKEN_ENDPOINT | Falls back to MGMT | https://auth.apps.paloaltonetworks.com/oauth2/access_token |
Regional Endpoints
Override endpoint variables for non-US deployments. The scan client also exports AIRS_ENDPOINTS with the verified scan hosts:
# Scan API regional hosts
export PANW_AI_SEC_API_ENDPOINT=https://service-de.api.aisecurity.paloaltonetworks.com # EU
export PANW_AI_SEC_API_ENDPOINT=https://service-in.api.aisecurity.paloaltonetworks.com # India
export PANW_AI_SEC_API_ENDPOINT=https://service-sg.api.aisecurity.paloaltonetworks.com # Singapore
# EU
export PANW_MGMT_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/aisec
export PANW_MODEL_SEC_DATA_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/aims/data
export PANW_MODEL_SEC_MGMT_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/aims/mgmt
export PANW_RED_TEAM_DATA_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/ai-red-teaming/data-plane
export PANW_RED_TEAM_MGMT_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/ai-red-teaming/mgmt-plane
# UK
export PANW_MGMT_ENDPOINT=https://api.uk.sase.paloaltonetworks.com/aisec
# FedRAMP
export PANW_MGMT_ENDPOINT=https://api.gov.sase.paloaltonetworks.com/aisec
If you use the same OAuth2 client for all services, you only need to set PANW_MGMT_CLIENT_ID, PANW_MGMT_CLIENT_SECRET, and PANW_MGMT_TSG_ID. The Model Security, Red Team, and AI Gateway clients will use these automatically.
Debug Logging
Set PANW_AI_SEC_DEBUG to 1, true, yes, or on to log each HTTP request and response to stderr. The SDK hashes Authorization and x-pan-token values before logging, but request and response bodies are logged verbatim, so keep this disabled in production.
PANW_AI_SEC_DEBUG=1 npx tsx --env-file=.env docs-site/examples/red-team-scans.ts
See Environment Variables for the complete reference.