Prisma SASE Python SDK

6.6.2b1 verified Fri May 01 auth: no python

Python3 SDK for the Prisma SASE AppFabric by Palo Alto Networks. Provides full API access to Prisma SASE (formerly CloudGenix) controller endpoints. Current version 6.6.2b1 (beta), released Feb 2026. Actively maintained with frequent minor version bumps.

pip install prisma-sase

Common errors

error ModuleNotFoundError: No module named 'prisma_sase' ↓

cause Package not installed or installed under a different name (e.g., 'prisma_sase' vs 'prisma-sase').

fix

Run 'pip install prisma-sase' and ensure your environment uses the correct package name.

error prisma_sase.exceptions.AuthenticationError: Unable to authenticate ↓

cause Invalid client_id, client_secret, or token_url. Often due to missing/null environment variables.

fix

Verify all four required env vars are set: PRISMA_CLIENT_ID, PRISMA_CLIENT_SECRET, PRISMA_CONTROLLER, PRISMA_TOKEN_URL.

error prisma_sase.exceptions.SaseAPIError: Invalid tenant ID ↓

cause The tenant ID passed to get_tenants() or similar is malformed or belongs to a different region.

fix

Use controller.get_tenants() to list valid tenants first, then use the correct tenant_id string.

Warnings

breaking Major version increments in API endpoints (e.g., prismasase_connections_configs v2.1→v3.0) may break SDK calls. Check the controller release notes before upgrading SDK. ↓

fix Review Changelog for API major version changes and update your code accordingly.

gotcha The `SaseController` constructor's `controller` parameter must be the full URL, not just hostname. Missing 'https://' will cause obscure connection errors. ↓

fix Always use full URL starting with https:// (e.g., 'https://api.sase.paloaltonetworks.com').

gotcha Token URL is region-specific. Using the wrong token URL (e.g., Americas vs Europe) will fail silently. The SDK does not auto-detect region. ↓

fix Set token_url to the correct regional endpoint: Americas='https://auth.apps.paloaltonetworks.com/oauth2/access_token', Europe='https://auth-eu.apps.paloaltonetworks.com/oauth2/access_token'.

Imports

SaseController

wrong

from prisma_sase.sase_controller import SaseController

correct

from prisma_sase import SaseController

Older docs showed deep submodule import – breaks in recent versions.

PrismaAuthentication

wrong

from prisma_sase import Authentication

correct

from prisma_sase.authentication import PrismaAuthentication

Authentication class is inside `authentication` module.

Quickstart

Authenticate and list tenants. Set env vars PRISMA_CLIENT_ID, PRISMA_CLIENT_SECRET, PRISMA_CONTROLLER, PRISMA_TOKEN_URL.

import os
from prisma_sase import SaseController

controller = SaseController(
    controller=os.environ.get('PRISMA_CONTROLLER', 'https://api.sase.paloaltonetworks.com'),
    client_id=os.environ.get('PRISMA_CLIENT_ID', ''),
    client_secret=os.environ.get('PRISMA_CLIENT_SECRET', ''),
    token_url=os.environ.get('PRISMA_TOKEN_URL', 'https://auth.apps.paloaltonetworks.com/oauth2/access_token')
)
controller.authenticate()
tenants = controller.get_tenants()
print(tenants)