Configuration

All SDK clients can be configured via constructor options or environment variables. Copy .env.example to .env to get started.

cp .env.example .env

Scan API

The Scan API is configured globally with init(). It requires either an API key or a pre-obtained bearer token.

Env Var	Required	Default
PANW_AI_SEC_API_KEY	One of key/token	—
PANW_AI_SEC_API_TOKEN	One of key/token	—
PANW_AI_SEC_API_ENDPOINT	No	https://service.api.aisecurity.paloaltonetworks.com

import { AIRS_ENDPOINTS, init } from '@cdot65/prisma-airs-sdk';

init({
  apiKey: process.env.PANW_AI_SEC_API_KEY,
  apiEndpoint: AIRS_ENDPOINTS.EU,
  numRetries: 3,
});

numRetries is supported by all SDK clients, accepts values from 0 to 5, and defaults to 5. Every Scanner method also accepts a per-call override. This is useful for giving an async POST one fetch attempt while retaining bounded retries for idempotent polling GETs:

const receipt = await scanner.asyncScan(batch, { numRetries: 0 });
const rows = await scanner.queryByScanIds([receipt.scan_id], { numRetries: 2 });

Omitting the per-call option uses the global value. numRetries counts retries after the initial attempt, so 0 means one total attempt and 5 permits six total attempts.

Management API

Env Var	Required	Default
PANW_MGMT_CLIENT_ID	Yes	—
PANW_MGMT_CLIENT_SECRET	Yes	—
PANW_MGMT_TSG_ID	Yes	—
PANW_MGMT_ENDPOINT	No	https://api.apps.paloaltonetworks.com/aisec
PANW_MGMT_TOKEN_ENDPOINT	No	https://auth.apps.paloaltonetworks.com/oauth2/access_token

The DLP namespace (client.dlp) reuses these OAuth credentials. Its base URL defaults to https://api.dlp.paloaltonetworks.com and is overridden with the ManagementClient constructor, not an environment variable:

import { ManagementClient } from '@cdot65/prisma-airs-sdk';

const client = new ManagementClient({
  dlpEndpoint: 'https://api.dlp.paloaltonetworks.com',
});

Model Security API

Falls back to PANW_MGMT_* variables if service-specific ones are not set.

Env Var	Required	Default
PANW_MODEL_SEC_CLIENT_ID	Falls back to MGMT	—
PANW_MODEL_SEC_CLIENT_SECRET	Falls back to MGMT	—
PANW_MODEL_SEC_TSG_ID	Falls back to MGMT	—
PANW_MODEL_SEC_DATA_ENDPOINT	No	https://api.apps.paloaltonetworks.com/aims/data
PANW_MODEL_SEC_MGMT_ENDPOINT	No	https://api.apps.paloaltonetworks.com/aims/mgmt
PANW_MODEL_SEC_TOKEN_ENDPOINT	Falls back to MGMT	https://auth.apps.paloaltonetworks.com/oauth2/access_token

Red Team API

Falls back to PANW_MGMT_* variables if service-specific ones are not set.

Env Var	Required	Default
PANW_RED_TEAM_CLIENT_ID	Falls back to MGMT	—
PANW_RED_TEAM_CLIENT_SECRET	Falls back to MGMT	—
PANW_RED_TEAM_TSG_ID	Falls back to MGMT	—
PANW_RED_TEAM_DATA_ENDPOINT	No	https://api.apps.paloaltonetworks.com/ai-red-teaming/data-plane
PANW_RED_TEAM_MGMT_ENDPOINT	No	https://api.apps.paloaltonetworks.com/ai-red-teaming/mgmt-plane
PANW_RED_TEAM_NETWORK_BROKER_ENDPOINT	No	https://api.apps.paloaltonetworks.com/ai-red-teaming/data-plane/network-broker
PANW_RED_TEAM_TOKEN_ENDPOINT	Falls back to MGMT	https://auth.apps.paloaltonetworks.com/oauth2/access_token

AI Gateway API

Falls back to PANW_MGMT_* variables if service-specific ones are not set. PANW_AI_GW_TSG_ID is also sent as the x-tsg-id header on every request.

Env Var	Required	Default
PANW_AI_GW_CLIENT_ID	Falls back to MGMT	—
PANW_AI_GW_CLIENT_SECRET	Falls back to MGMT	—
PANW_AI_GW_TSG_ID	Falls back to MGMT	—
PANW_AI_GW_DATA_ENDPOINT	No	https://api.apps.paloaltonetworks.com/ai_gw/v2
PANW_AI_GW_ADMIN_ENDPOINT	No	https://api.apps.paloaltonetworks.com/ai_gw/admin/v2
PANW_AI_GW_TOKEN_ENDPOINT	Falls back to MGMT	https://auth.apps.paloaltonetworks.com/oauth2/access_token

Regional Endpoints

Override endpoint variables for non-US deployments. The scan client also exports AIRS_ENDPOINTS with the verified scan hosts:

# Scan API regional hosts
export PANW_AI_SEC_API_ENDPOINT=https://service-de.api.aisecurity.paloaltonetworks.com  # EU
export PANW_AI_SEC_API_ENDPOINT=https://service-in.api.aisecurity.paloaltonetworks.com  # India
export PANW_AI_SEC_API_ENDPOINT=https://service-sg.api.aisecurity.paloaltonetworks.com  # Singapore

# EU
export PANW_MGMT_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/aisec
export PANW_MODEL_SEC_DATA_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/aims/data
export PANW_MODEL_SEC_MGMT_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/aims/mgmt
export PANW_RED_TEAM_DATA_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/ai-red-teaming/data-plane
export PANW_RED_TEAM_MGMT_ENDPOINT=https://api.eu.sase.paloaltonetworks.com/ai-red-teaming/mgmt-plane

# UK
export PANW_MGMT_ENDPOINT=https://api.uk.sase.paloaltonetworks.com/aisec

# FedRAMP
export PANW_MGMT_ENDPOINT=https://api.gov.sase.paloaltonetworks.com/aisec

Shared Credentials

If you use the same OAuth2 client for all services, you only need to set PANW_MGMT_CLIENT_ID, PANW_MGMT_CLIENT_SECRET, and PANW_MGMT_TSG_ID. The Model Security, Red Team, and AI Gateway clients will use these automatically.

Debug Logging

Set PANW_AI_SEC_DEBUG to 1, true, yes, or on to log each HTTP request and response to stderr. The SDK hashes Authorization and x-pan-token values. For AI Gateway operations with published secret metadata it also redacts known provider credentials, plugin credentials, auth settings, and one-time response secrets. Other body content is logged verbatim, so keep this disabled in production.

PANW_AI_SEC_DEBUG=1 npx tsx --env-file=.env docs-site/examples/red-team-scans.ts

See Environment Variables for the complete reference.