naftiko: 1.0.0-alpha2 info: label: Incident Security Service Posture Management API — SaaS Instance description: 'Incident Security Service Posture Management API — SaaS Instance. 9 operations. Lead operation: Palo Alto Networks Get SaaS Instance List. Self-contained Naftiko capability covering one Palo Alto Networks business surface.' tags: - Palo Alto Networks - SaaS Instance created: '2026-05-19' modified: '2026-05-19' binds: - namespace: env keys: PALO_ALTO_NETWORKS_API_KEY: PALO_ALTO_NETWORKS_API_KEY capability: consumes: - type: http namespace: palo-alto-identity-security-posture-management-saas-instance baseUri: https://api.sase.paloaltonetworks.com description: Incident Security Service Posture Management API — SaaS Instance business capability. Self-contained, no shared references. resources: - name: sspm-identity-v1-saas_instances path: /sspm/identity/v1/saas_instances operations: - name: saasinstancesget method: GET description: Palo Alto Networks Get SaaS Instance List outputRawFormat: json outputParameters: - name: result type: object value: $. inputParameters: - name: x-ps-tenant in: header type: string - name: sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts path: /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts operations: - name: saasinstancessaasaccountsget method: GET description: Palo Alto Networks Get SaaS Account List outputRawFormat: json outputParameters: - name: result type: object value: $. inputParameters: - name: saasInstanceId in: path type: string required: true - name: filter in: query type: string - name: limit in: query type: integer - name: page in: query type: integer - name: sortBy in: query type: string - name: x-ps-tenant in: header type: string - name: sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts-count path: /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/count operations: - name: saasinstancessaasaccountscountget method: GET description: Palo Alto Networks Get SaaS Account Count outputRawFormat: json outputParameters: - name: result type: object value: $. inputParameters: - name: saasInstanceId in: path type: string required: true - name: filter in: query type: string - name: x-ps-tenant in: header type: string - name: sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts-csv_report path: /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/csv_report operations: - name: saasinstancessaasaccountscountcsvreportpost method: POST description: Palo Alto Networks Generate SaaS Account CSV Report outputRawFormat: json outputParameters: - name: result type: object value: $. inputParameters: - name: saasInstanceId in: path type: string required: true - name: filter in: query type: string - name: sortBy in: query type: string - name: x-ps-tenant in: header type: string - name: body in: body type: object description: Request body (JSON). required: false - name: sspm-identity-v1-saas_instances-saasInstanceId-saas_activity path: /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_activity operations: - name: saasinstancessaasactivityget method: GET description: Palo Alto Networks Get SaaS Activity Logs outputRawFormat: json outputParameters: - name: result type: object value: $. inputParameters: - name: saasInstanceId in: path type: string required: true - name: filter in: query type: string - name: limit in: query type: integer - name: page in: query type: integer - name: sortBy in: query type: string - name: x-ps-tenant in: header type: string - name: sspm-identity-v1-saasInstanceId-tickets path: /sspm/identity/v1/{saasInstanceId}/tickets operations: - name: saasinstancesticketsget method: GET description: Palo Alto Networks Get SaaS Instance Tickets outputRawFormat: json outputParameters: - name: result type: object value: $. inputParameters: - name: saasInstanceId in: path type: string required: true - name: filter in: query type: string - name: limit in: query type: integer - name: page in: query type: integer - name: sortBy in: query type: string - name: x-ps-tenant in: header type: string - name: saasinstancesticketspost method: POST description: Palo Alto Networks Create SaaS Instance Ticket outputRawFormat: json outputParameters: - name: result type: object value: $. inputParameters: - name: saasInstanceId in: path type: string required: true - name: x-ps-tenant in: header type: string - name: body in: body type: object description: Request body (JSON). required: false - name: saasinstancesticketsdelete method: DELETE description: Palo Alto Networks Delete SaaS Instance Tickets outputRawFormat: json outputParameters: - name: result type: object value: $. inputParameters: - name: saasInstanceId in: path type: string required: true - name: x-ps-tenant in: header type: string - name: body in: body type: object description: Request body (JSON). required: false - name: sspm-identity-v1-saasInstanceId-tickets-ticketKey-issues path: /sspm/identity/v1/{saasInstanceId}/tickets/{ticketKey}/issues operations: - name: saasinstancesticketsissuesget method: GET description: Palo Alto Networks Get Ticket Issues outputRawFormat: json outputParameters: - name: result type: object value: $. inputParameters: - name: saasInstanceId in: path type: string required: true - name: ticketKey in: path type: string required: true - name: limit in: query type: integer - name: page in: query type: integer - name: x-ps-tenant in: header type: string exposes: - type: rest namespace: palo-alto-identity-security-posture-management-saas-instance-rest port: 8080 description: REST adapter for Incident Security Service Posture Management API — SaaS Instance. One Spectral-compliant resource per consumed operation, prefixed with /v1. resources: - path: /v1/sspm/identity/v1/saas-instances name: sspm-identity-v1-saas-instances description: REST surface for sspm-identity-v1-saas_instances. operations: - method: GET name: saasinstancesget description: Palo Alto Networks Get SaaS Instance List call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesget with: x-ps-tenant: rest.x-ps-tenant outputParameters: - type: object mapping: $. - path: /v1/sspm/identity/v1/saas-instances/{saasinstanceid}/saas-accounts name: sspm-identity-v1-saas-instances-saasinstanceid-saas-accounts description: REST surface for sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts. operations: - method: GET name: saasinstancessaasaccountsget description: Palo Alto Networks Get SaaS Account List call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountsget with: saasInstanceId: rest.saasInstanceId filter: rest.filter limit: rest.limit page: rest.page sortBy: rest.sortBy x-ps-tenant: rest.x-ps-tenant outputParameters: - type: object mapping: $. - path: /v1/sspm/identity/v1/saas-instances/{saasinstanceid}/saas-accounts/count name: sspm-identity-v1-saas-instances-saasinstanceid-saas-accounts-count description: REST surface for sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts-count. operations: - method: GET name: saasinstancessaasaccountscountget description: Palo Alto Networks Get SaaS Account Count call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountscountget with: saasInstanceId: rest.saasInstanceId filter: rest.filter x-ps-tenant: rest.x-ps-tenant outputParameters: - type: object mapping: $. - path: /v1/sspm/identity/v1/saas-instances/{saasinstanceid}/saas-accounts/csv-report name: sspm-identity-v1-saas-instances-saasinstanceid-saas-accounts-csv-report description: REST surface for sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts-csv_report. operations: - method: POST name: saasinstancessaasaccountscountcsvreportpost description: Palo Alto Networks Generate SaaS Account CSV Report call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountscountcsvreportpost with: saasInstanceId: rest.saasInstanceId filter: rest.filter sortBy: rest.sortBy x-ps-tenant: rest.x-ps-tenant body: rest.body outputParameters: - type: object mapping: $. - path: /v1/sspm/identity/v1/saas-instances/{saasinstanceid}/saas-activity name: sspm-identity-v1-saas-instances-saasinstanceid-saas-activity description: REST surface for sspm-identity-v1-saas_instances-saasInstanceId-saas_activity. operations: - method: GET name: saasinstancessaasactivityget description: Palo Alto Networks Get SaaS Activity Logs call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasactivityget with: saasInstanceId: rest.saasInstanceId filter: rest.filter limit: rest.limit page: rest.page sortBy: rest.sortBy x-ps-tenant: rest.x-ps-tenant outputParameters: - type: object mapping: $. - path: /v1/sspm/identity/v1/{saasinstanceid}/tickets name: sspm-identity-v1-saasinstanceid-tickets description: REST surface for sspm-identity-v1-saasInstanceId-tickets. operations: - method: GET name: saasinstancesticketsget description: Palo Alto Networks Get SaaS Instance Tickets call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsget with: saasInstanceId: rest.saasInstanceId filter: rest.filter limit: rest.limit page: rest.page sortBy: rest.sortBy x-ps-tenant: rest.x-ps-tenant outputParameters: - type: object mapping: $. - method: POST name: saasinstancesticketspost description: Palo Alto Networks Create SaaS Instance Ticket call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketspost with: saasInstanceId: rest.saasInstanceId x-ps-tenant: rest.x-ps-tenant body: rest.body outputParameters: - type: object mapping: $. - method: DELETE name: saasinstancesticketsdelete description: Palo Alto Networks Delete SaaS Instance Tickets call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsdelete with: saasInstanceId: rest.saasInstanceId x-ps-tenant: rest.x-ps-tenant body: rest.body outputParameters: - type: object mapping: $. - path: /v1/sspm/identity/v1/{saasinstanceid}/tickets/{ticketkey}/issues name: sspm-identity-v1-saasinstanceid-tickets-ticketkey-issues description: REST surface for sspm-identity-v1-saasInstanceId-tickets-ticketKey-issues. operations: - method: GET name: saasinstancesticketsissuesget description: Palo Alto Networks Get Ticket Issues call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsissuesget with: saasInstanceId: rest.saasInstanceId ticketKey: rest.ticketKey limit: rest.limit page: rest.page x-ps-tenant: rest.x-ps-tenant outputParameters: - type: object mapping: $. - type: mcp namespace: palo-alto-identity-security-posture-management-saas-instance-mcp port: 9090 transport: http description: MCP adapter for Incident Security Service Posture Management API — SaaS Instance. One tool per consumed operation, routed inline through this capability's consumes block. tools: - name: palo-alto-networks-get-saas description: Palo Alto Networks Get SaaS Instance List hints: readOnly: true destructive: false idempotent: true call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesget with: x-ps-tenant: tools.x-ps-tenant outputParameters: - type: object mapping: $. - name: palo-alto-networks-get-saas-2 description: Palo Alto Networks Get SaaS Account List hints: readOnly: true destructive: false idempotent: true call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountsget with: saasInstanceId: tools.saasInstanceId filter: tools.filter limit: tools.limit page: tools.page sortBy: tools.sortBy x-ps-tenant: tools.x-ps-tenant outputParameters: - type: object mapping: $. - name: palo-alto-networks-get-saas-3 description: Palo Alto Networks Get SaaS Account Count hints: readOnly: true destructive: false idempotent: true call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountscountget with: saasInstanceId: tools.saasInstanceId filter: tools.filter x-ps-tenant: tools.x-ps-tenant outputParameters: - type: object mapping: $. - name: palo-alto-networks-generate-saas description: Palo Alto Networks Generate SaaS Account CSV Report hints: readOnly: false destructive: false idempotent: false call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountscountcsvreportpost with: saasInstanceId: tools.saasInstanceId filter: tools.filter sortBy: tools.sortBy x-ps-tenant: tools.x-ps-tenant body: tools.body outputParameters: - type: object mapping: $. - name: palo-alto-networks-get-saas-4 description: Palo Alto Networks Get SaaS Activity Logs hints: readOnly: true destructive: false idempotent: true call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasactivityget with: saasInstanceId: tools.saasInstanceId filter: tools.filter limit: tools.limit page: tools.page sortBy: tools.sortBy x-ps-tenant: tools.x-ps-tenant outputParameters: - type: object mapping: $. - name: palo-alto-networks-get-saas-5 description: Palo Alto Networks Get SaaS Instance Tickets hints: readOnly: true destructive: false idempotent: true call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsget with: saasInstanceId: tools.saasInstanceId filter: tools.filter limit: tools.limit page: tools.page sortBy: tools.sortBy x-ps-tenant: tools.x-ps-tenant outputParameters: - type: object mapping: $. - name: palo-alto-networks-create-saas description: Palo Alto Networks Create SaaS Instance Ticket hints: readOnly: false destructive: false idempotent: false call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketspost with: saasInstanceId: tools.saasInstanceId x-ps-tenant: tools.x-ps-tenant body: tools.body outputParameters: - type: object mapping: $. - name: palo-alto-networks-delete-saas description: Palo Alto Networks Delete SaaS Instance Tickets hints: readOnly: false destructive: true idempotent: true call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsdelete with: saasInstanceId: tools.saasInstanceId x-ps-tenant: tools.x-ps-tenant body: tools.body outputParameters: - type: object mapping: $. - name: palo-alto-networks-get-ticket description: Palo Alto Networks Get Ticket Issues hints: readOnly: true destructive: false idempotent: true call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsissuesget with: saasInstanceId: tools.saasInstanceId ticketKey: tools.ticketKey limit: tools.limit page: tools.page x-ps-tenant: tools.x-ps-tenant outputParameters: - type: object mapping: $.