The Portnox REST API is a programmatic interface that lets security and IT teams connect Portnox Cloud’s zero trust access control to the rest of their stack, identity providers, MDM, SIEM, EDR/XDR, and custom tools, without manual configuration or professional services. Because it follows standard REST conventions, any tool that can make an HTTP request can pull device posture data, trigger policy changes, or automate onboarding, so your security tools work together instead of sitting in silos.
Nothing is more frustrating than spending hours on the phone with support, trying to get all your different security tools to work together…or spending more than the solution actually costs on professional services to achieve this same goal. Portnox has several out-of-the-box integrations for a variety of vendors – from Aruba to Zytel, we’ll integrate into the fabric of your zero trust security architecture.
From identity providers to MDM and SIEM solutions, Portnox fits right in. We have several out-of-the-box guides for the most common integrations, and we’ll help you get everything up and running so you can rest assured your network is protected.
Rest API
The Portnox REST API is a programmatic interface that lets you manage accounts, devices, and access policies in Portnox Cloud using standard HTTP requests. It’s built for automation, letting security and IT teams connect Portnox to identity providers, SIEM, EDR/XDR, and SOAR tools without manual configuration or custom middleware.
With the Portnox REST API, you can automate account and MAC-based account management, query, block, or delete devices, and trigger access changes based on external events. A common use case is auto-blocking a device the moment a SOAR platform detects a threat, without waiting on manual intervention.
Every request to the Portnox REST API requires authorization first; unauthorized calls fail before any data is returned. You can authorize with an API key (Bearer token) or a local Portnox Cloud administrator account. External identity providers like Entra ID or Google Workspace can’t be used to authorize API access directly.
Yes. The Portnox Cloud API enforces a limit of 10 requests per 10 seconds per tenant. Requests beyond that limit may be throttled or rejected, so scripts and integrations calling the API in bulk should build in pacing or batching to stay within the limit.
Full Swagger/OpenAPI documentation, including every available endpoint and live testing tools, is available directly inside your Portnox Cloud tenant under Help > API Reference. You can test real operations there, or copy a ready-to-use curl request for your own scripts.
Yes. The Portnox API lets SIEM, EDR, and SOAR tools pull device and access data from Portnox Cloud, or push actions back, such as automatically blocking a device flagged as compromised. This closes the loop between detection tools and actual network access enforcement.
You’ve started your zero trust journey—now level up your network.
Explore what’s next on the path to total cloud-native access control. One platform. No weak spots. Just smarter security with every step.
