openapi: 3.2.0 info: contact: email: support@paloaltonetworks.com description: 'The Open API specification file represents the APIs available for Prisma Access Insights 3.0. The Prisma Access Insights 3.0 APIs allow you to query your Prisma Access tenant for the health of your Prisma Access network deployment. The 3.0 APIs are intended for cloud-managed Prisma Access customers, where the tenants have been onboarded by Palo Alto Networks using a Tenant Service Group (TSG) identifier. These APIs use the common SASE authentication mechanism and base URL. See the [Prisma SASE API Get Started](https://pan.dev/sase/docs/getstarted) guide for more information. This Open API spec file was created on May 30, 2025. To check for a more recent version of this file, see [Prisma Insights APIs on pan.dev](https://pan.dev//access/api/insights/). © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html) All other marks mentioned herein may be trademarks of their respective companies. ' license: name: MIT url: https://opensource.org/license/mit termsOfService: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-end-user-license-agreement-eula.pdf title: Palo Alto Networks 3.0 Application API API version: '3.0' servers: - url: https://api.sase.paloaltonetworks.com tags: - description: 'Application API ' name: Application API paths: /insights/v3.0/resource/query/accelerated_applications/accelerated_application_list: post: description: 'Retrieve a list of accelerated applications with summary information. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-accelerated_application_list parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: equals property: app_accelerated values: - true - operator: in property: app values: - salesforce - zoom schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: salesforce type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: accelerated_user_count: description: Number of users with accelerated application experience. example: 100 type: integer app: description: Application name. example: salesforce type: string app_accelerated: description: Indicates if the application is accelerated. example: true type: boolean avg_throughput: description: Average throughput for the application. example: 500000.0 format: float type: number better_response_time: description: Improved response time for the application. example: 0.2 format: float type: number total_data_transfer: description: Total data transferred for the application. example: 1000000.0 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Accelerated Application List tags: - Application API /insights/v3.0/resource/query/accelerated_applications/accelerated_applications/throughput_before_after_boost_histogram: post: description: 'Retrieve a histogram of throughput metrics before and after boost for accelerated applications. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-accelerated_applications-throughput_before_after_boost_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: in property: app_accelerated values: - true - false - operator: in property: app values: - Zoom - Salesforce histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application Name example: Zoom type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Locations example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object histogram: properties: enableEmptyInterval: description: Enable empty interval example: true type: boolean property: description: Property for histogram example: event_time type: string range: description: Range of histogram example: minute type: string value: description: Value of histogram example: 30 type: integer type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time example: 1709226000000 type: number throughput_after_acceleration: description: Throughput after acceleration example: 2000000.0 format: float type: number throughput_before_acceleration: description: Throughput before acceleration example: 1000000.0 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Accelerated Applications Throughput Histogram tags: - Application API /insights/v3.0/resource/query/accelerated_applications/applications_count: post: description: 'Retrieve the number of accelerated applications. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-applications_count parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: equals property: app_accelerated values: - true - operator: in property: app values: - Zoom - Salesforce schema: properties: filter: properties: rules: items: properties: app: description: Application Name. example: Zoom type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: applications_accelerated: description: Count of accelerated applications. example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Retrieve Accelerated Applications Data tags: - Application API /insights/v3.0/resource/query/accelerated_applications/better_response_time: post: description: 'Retrieve data related to accelerated applications and their response times. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-better_response_time parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: equals property: app_accelerated values: - true - operator: in property: app values: - Zoom - Salesforce schema: properties: filter: properties: rules: items: properties: app: description: Application Name. example: Zoom type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: better_response_time: description: Response time of the accelerated application. example: 0.5 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Retrieve Application Response Time Data tags: - Application API /insights/v3.0/resource/query/accelerated_applications/data_transfer_throughput_per_app: post: description: 'Retrieve data transfer and throughput metrics for specific accelerated applications. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-data_transfer_throughput_per_app parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: in property: app values: - salesforce - zoom schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: salesforce type: string edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 1678886400000 type: number type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: app: description: Application name. example: salesforce type: string avg_throughput: description: Average throughput in bytes per second. example: 1000000.0 format: float type: number total_data_transfer: description: Total data transferred in bytes. example: 1000000000.0 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Data Transfer Throughput Per Application tags: - Application API /insights/v3.0/resource/query/accelerated_applications/packet_loss_per_app_histogram: post: description: 'Retrieve a histogram of packet loss for specific accelerated applications. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-packet_loss_per_app_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: in property: app_accelerated values: - true - false - operator: in property: app values: - Zoom - Salesforce histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application Name example: Zoom type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Locations example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object histogram: properties: enableEmptyInterval: description: Whether to enable empty intervals in the histogram. example: true type: boolean property: description: The property to create a histogram for. example: event_time type: string range: description: The range for the histogram. example: minute type: string value: description: The value for the histogram range. example: 30 type: integer type: object type: object required: true responses: '200': content: application/json: schema: properties: app: description: Application Name example: Zoom type: string event_time: description: Event time example: 1709226000000 type: number packet_loss: description: Packet loss percentage example: 0.05 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Packet Loss Per Application Histogram tags: - Application API /insights/v3.0/resource/query/accelerated_applications/performance_boost: post: description: 'Retrieve performance boost metrics for accelerated applications. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-performance_boost parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: equals property: app_accelerated values: - true schema: properties: filter: properties: rules: items: properties: app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: performance_boost: description: Performance boost metric. example: 0.15 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Performance Boost Data for Applications tags: - Application API /insights/v3.0/resource/query/accelerated_applications/rtt_variance_histogram: post: description: 'Retrieve a histogram of RTT variance metrics for accelerated applications. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-rtt_variance_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: in property: app_accelerated values: - true - operator: in property: app values: - Zoom histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application Name example: Zoom type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Locations example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object histogram: properties: enableEmptyInterval: description: Enable empty intervals example: true type: boolean property: description: Property to create histogram example: event_time type: string range: description: Range of histogram example: minute type: string value: description: Value of histogram example: 30 type: integer type: object type: object required: true responses: '200': content: application/json: schema: properties: app: description: Application Name example: Zoom type: string event_time: description: Event time example: 1709226000000 type: number rtt_variance: description: RTT Variance example: 10.5 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: RTT Variance Histogram tags: - Application API /insights/v3.0/resource/query/accelerated_applications/throughput_per_app_histogram: post: description: 'Retrieve a histogram of throughput metrics for specific accelerated applications. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-throughput_per_app_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: equals property: app_accelerated values: - true - operator: in property: app values: - Zoom histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application Name example: Zoom type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Locations example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object histogram: properties: enableEmptyInterval: description: Enable empty interval example: true type: boolean property: description: Property for histogram example: event_time type: string range: description: Range of histogram example: minute type: string value: description: Value of histogram example: 30 type: integer type: object type: object required: true responses: '200': content: application/json: schema: properties: app: description: Application Name example: Zoom type: string avg_throughput: description: Average throughput of the application example: 1000000.0 format: float type: number event_time: description: Event time example: 1709226000000 type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Throughput Per Application Histogram tags: - Application API /insights/v3.0/resource/query/accelerated_applications/total_data_transfer: post: description: 'Retrieve total data transfer metrics for accelerated applications, including average total bytes. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-total_data_transfer parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: in property: app_accelerated values: - true - false - operator: in property: app values: - salesforce - zoom schema: properties: filter: properties: rules: items: properties: app: description: Application Name. example: salesforce type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: avg_total_bytes: description: Average total bytes transferred. example: 1000000.0 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Total Data Transfer for Applications tags: - Application API /insights/v3.0/resource/query/accelerated_applications/users_count: post: description: 'Retrieve the number of users for accelerated applications. ' operationId: post-insights-v3.0-resource-query-accelerated_applications-users_count parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: in property: app_accelerated values: - true - false schema: properties: filter: properties: rules: items: properties: app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: users_accelerated: description: Count of users with accelerated applications. example: 100 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Accelerated Applications Users Data tags: - Application API /insights/v3.0/resource/query/app_details_bw_info_histogram: post: description: 'Retrieve application bandwidth details, including total, upload, and download data usage, presented as a histogram. ' operationId: post-insights-v3.0-resource-query-app_details_bw_info_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: app values: - Zoom - operator: in property: platform_type values: - prisma_access - operator: in property: application_name values: - Zoom Meetings histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application Name example: Zoom type: string application_name: description: Application Name example: Zoom Meetings type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Type of platform example: prisma_access type: string type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: download_data_usage: description: Download Data Usage. example: 100 type: integer event_time: description: Event time example: 1709226000000 type: number total_data_usage: description: Total Data Usage. example: 1000 type: integer upload_data_usage: description: Upload Data Usage. example: 100 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Application Bandwidth Histogram tags: - Application API /insights/v3.0/resource/query/applications/accelerated_applications/response_time_before_and_after_improvement: post: description: Retrieves response time data for accelerated applications presenting response time before and after improvement. operationId: post-insights-v3.0-resource-query-applications-accelerated_applications-response_time_before_and_after_improvement parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: equals property: app_accelerated values: - true - operator: in property: app values: - salesforce histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: salesforce type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object histogram: properties: enableEmptyInterval: description: Enable empty intervals. example: true type: boolean property: description: Property for histogram. example: event_time type: string range: description: Range for histogram. example: minute type: string value: description: Value for histogram. example: 30 type: integer type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time. example: 1709226000000 type: number response_time_after_improvement: description: Response time after improvement. example: 50.0 format: float type: number response_time_before_improvement: description: Response time before improvement. example: 100.0 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Response time before and after improvement tags: - Application API /insights/v3.0/resource/query/applications/accelerated_applications/response_time_before_and_after_improvement_per_app: post: description: Retrieves response time data for accelerated applications presenting response time before and after improvement for an particular application. operationId: post-insights-v3.0-resource-query-applications-accelerated_applications-response_time_before_and_after_improvement_per_app parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: edge_location_display_name values: - US West - operator: in property: app_accelerated values: - true - false - operator: in property: app values: - salesforce histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: salesforce type: string app_accelerated: description: Whether the application is accelerated. example: true type: boolean edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number type: object required: - event_time type: array type: object histogram: properties: enableEmptyInterval: description: Enable empty intervals. example: true type: boolean property: description: Property for histogram. example: event_time type: string range: description: Range for histogram. example: minute type: string value: description: Value for histogram. example: 30 type: integer type: object type: object required: true responses: '200': content: application/json: schema: properties: app: description: Application name. example: salesforce type: string event_time: description: Event time. example: 1678886400000 type: number response_time_after_improvement: description: Response time after improvement. example: 0.89 format: float type: number response_time_before_improvement: description: Response time before improvement. example: 1.23 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Response time improvement per application tags: - Application API /insights/v3.0/resource/query/applications/app_info: post: description: 'Retrieve detailed application information, including threats and traffic details. ' operationId: post-insights-v3.0-resource-query-applications-app_info parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: in property: app values: - outlook With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: app values: - outlook - operator: in property: platform_type values: - prisma_access - operator: in property: security_service_type values: - url_filtering - operator: in property: severity values: - critical - operator: in property: app_category values: - business - operator: in property: risk_of_app values: - fair - operator: in property: edge_location_display_name values: - US West - operator: in property: threat_category_group values: - malware - operator: eq property: threats_active values: - true - operator: in property: application_type values: - web-app - operator: in property: source_type values: - user schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: outlook type: string app_category: description: Category of the application. example: business type: string application_type: description: Type of application. example: web-app type: string edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Type of platform. example: prisma_access type: string risk_of_app: description: Risk of the application. example: fair type: string security_service_type: description: Type of security service. example: url_filtering type: string severity: description: Severity of the event. example: critical type: string source_type: description: Source type. enum: - user - iot - other example: user type: string threat_category_group: description: Threat category group. example: malware type: string threats_active: description: Are threats active? example: true type: boolean type: object required: - app type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: application_sub_type: description: Sub type of application. example: web type: string category: description: Category of the application. example: business type: string data_used_in_models: description: Is data used in models? example: true type: boolean description: description: Description of the application. example: Microsoft Outlook is an email application. type: string icon: description: URL to the application icon. example: https://example.com/outlook.png type: string popularity: description: Popularity of the application. example: high type: string ports: description: Ports used by the application. example: - 80 - 443 items: type: integer type: array risk_of_app: description: Risk of the application. example: 3 type: integer rule_count: description: Number of rules associated with the application. example: 10 type: integer status: description: Status of the application. example: active type: string sub_category: description: Sub-category of the application. example: email type: string use_cases: description: Use cases of the application. example: - communication - productivity items: type: string type: array type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Retrieve Application Information tags: - Application API /insights/v3.0/resource/query/applications/internal/app_by_risk_score: post: description: Retrieves application risk score data including risk of apps and count of apps. operationId: post-insights-v3.0-resource-query-applications-internal-app_by_risk_score parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: app values: - Zoom - operator: in property: app_category values: - Collaboration - operator: in property: risk_of_app values: - 0 - operator: in property: edge_location_display_name values: - US West - operator: in property: platform_type values: - prisma_access - operator: in property: application_type values: - Business - operator: in property: security_service_type values: - url_filtering - operator: in property: source_type values: - user - operator: eq property: threats_active values: - true - operator: eq property: severity values: - true - operator: in property: threat_category_group values: - Malware - operator: in property: normalized_tag values: - cloud-storage - operator: in property: use_cases values: - data-loss-prevention - operator: eq property: is_genai values: - true schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Zoom type: string app_category: description: Application category. example: Collaboration type: string application_type: description: Application Type. example: Business type: string edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number is_genai: description: Is it a GenAI application? example: true type: boolean normalized_tag: description: Normalized tag. example: cloud-storage type: string platform_type: description: Platform type. example: prisma_access type: string risk_of_app: description: Risk score of the application. enum: - 0 - 1 - 2 - 3 - 4 - 5 example: 0 type: integer security_service_type: description: Security service type. enum: - url_filtering - threat_protection - wildfire example: url_filtering type: string severity: description: Severity of threats. example: true type: boolean source_type: description: Source type. enum: - user - iot - other example: user type: string threat_category_group: description: Threat category group. example: Malware type: string threats_active: description: Are threats active? example: true type: boolean use_cases: description: Use cases. example: data-loss-prevention type: string type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: count_apps: description: Number of applications. example: 10 type: integer risk_of_app: description: Risk score of the application. example: 3 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get Application Risk Score tags: - Application API /insights/v3.0/resource/query/applications/internal/app_by_tag: post: description: Retrieves applications by tag including application sub type and count of applications with associated metadata. operationId: post-insights-v3.0-resource-query-applications-internal-app_by_tag parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: app values: - Zoom - operator: in property: app_category values: - Collaboration - operator: in property: risk_of_app values: - '0' - operator: in property: edge_location_display_name values: - US West - operator: in property: platform_type values: - prisma_access - operator: in property: application_type values: - Web - operator: in property: security_service_type values: - url_filtering - operator: in property: source_type values: - user - operator: eq property: threats_active values: - true - operator: eq property: severity values: - true - operator: in property: threat_category_group values: - Malware - operator: in property: normalized_tag values: - finance - operator: in property: use_cases values: - data-loss-prevention - operator: eq property: is_genai values: - true schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Zoom type: string app_category: description: Application category. example: Collaboration type: string application_type: description: Type of application. example: Web type: string edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number is_genai: description: Indicates if the application is GenAI. example: true type: boolean normalized_tag: description: Normalized tag. example: finance type: string platform_type: description: Platform type. example: prisma_access type: string risk_of_app: description: Risk level of the application. example: 0 type: integer security_service_type: description: Type of security service. enum: - url_filtering - threat_protection - wildfire example: url_filtering type: string severity: description: Indicates the severity of the threat. example: true type: boolean source_type: description: Source type. enum: - user - iot - other example: user type: string threat_category_group: description: Threat category group. example: Malware type: string threats_active: description: Indicates if threats are active. example: true type: boolean use_cases: description: Use cases. example: data-loss-prevention type: string type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: application_sub_type: description: Application subtype. example: Web App type: string count_apps: description: Count of applications. example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get Applications by Tag tags: - Application API /insights/v3.0/resource/query/applications/internal/application_list: post: description: Retrieves a list of applications with detailed metrics and threat information. operationId: post-insights-v3.0-resource-query-applications-internal-application_list parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: app values: - Zoom - operator: in property: app_category values: - collaboration - operator: in property: risk_of_app values: - 3 - operator: in property: edge_location_display_name values: - US West - operator: in property: user_exp_score values: - 4 - operator: in property: site_exp_score values: - 5 - operator: in property: user_exp_score_verdict values: - good - operator: in property: site_exp_score_verdict values: - good - operator: in property: usergroups values: - Employees - operator: in property: normalized_username values: - john.doe - operator: in property: experience_score values: - good - operator: in property: application_name values: - Zoom - operator: in property: platform_type values: - prisma_access - operator: in property: application_type values: - web-based - operator: in property: security_service_type values: - url_filtering - operator: in property: source_type values: - user - operator: in property: threats_active values: - true - operator: in property: severity values: - true - operator: in property: threat_category_group values: - malware - operator: in property: normalized_tag values: - critical - operator: in property: use_cases values: - business - operator: in property: is_genai values: - true - operator: in property: quantum_status_tag values: - enabled schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Zoom type: string app_category: description: Application category. example: collaboration type: string application_name: description: Application name. example: Zoom type: string application_type: description: Application type. example: web-based type: string edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 1678886400000 type: number experience_score: description: Experience score. example: good type: string is_genai: description: Indicates if it is GenAI. example: true type: boolean normalized_tag: description: Normalized tag. example: critical type: string normalized_username: description: Normalized username. example: john.doe type: string platform_type: description: Platform type. example: prisma_access type: string quantum_status_tag: description: Quantum status tag. example: enabled type: string risk_of_app: description: Risk level of the application. example: 3 type: integer security_service_type: description: Security service type. example: url_filtering type: string severity: description: Indicates the severity of threats. example: true type: boolean site_exp_score: description: Site experience score. example: 5 type: integer site_exp_score_verdict: description: Site experience score verdict. example: good type: string source_type: description: Source type. example: user type: string threat_category_group: description: Threat category group. example: malware type: string threats_active: description: Indicates if threats are active. example: true type: boolean use_cases: description: Use cases. example: business type: string user_exp_score: description: User experience score. example: 4 type: integer user_exp_score_verdict: description: User experience score verdict. example: good type: string usergroups: description: User groups. example: Employees type: string type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: accelerated: description: Indicates if the application is accelerated. example: true type: boolean app: description: Application name. example: Zoom type: string app_category: description: Application category. example: collaboration type: string app_sub_category: description: Application sub-category. example: video-conferencing type: string application_sub_type: description: Application sub type. example: web type: string application_test_name: description: Application test name. example: Zoom Test type: string application_test_target_name: description: Application test target name. example: Zoom Target type: string avg_throughput: description: Average throughput. example: 1000000.0 format: float type: number pab_event_count: description: PAB event count. example: 20 type: integer port: description: Port number. example: 443 type: integer quantum_status_tag: description: Quantum status tag. example: enabled type: string risk_of_app: description: Risk level of the application. example: 3 type: integer rule_name: description: Rule name. example: Zoom Rule type: string site_exp_score: description: Site experience score. example: 5 type: integer site_exp_score_verdict: description: Site experience score verdict. example: good type: string site_exp_test_uuid: description: Site experience test UUID. example: 550e8400-e29b-41d4-a716-446655440001 type: string total_threats: description: Total number of threats detected. example: 10 type: integer url_count: description: Number of URLs. example: 50 type: integer usage_bytes: description: Total usage in bytes. example: 1000000000.0 format: float type: number user_count: description: Number of users. example: 100 type: integer user_exp_score: description: User experience score. example: 4 type: integer user_exp_score_verdict: description: User experience score verdict. example: good type: string user_exp_test_uuid: description: User experience test UUID. example: 550e8400-e29b-41d4-a716-446655440000 type: string type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get Application List tags: - Application API /insights/v3.0/resource/query/applications/internal/total_data_transfer_application: post: description: Retrieves the total data transfer for each application. This includes information such as category of an application and total data usage. operationId: post-insights-v3.0-resource-query-applications-internal-total_data_transfer_application parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: app values: - Zoom - operator: in property: app_category values: - collaboration - operator: in property: risk_of_app values: - 0 - operator: in property: edge_location_display_name values: - US West - operator: in property: platform_type values: - prisma_access - operator: in property: application_type values: - web-based - operator: in property: security_service_type values: - url_filtering - operator: in property: source_type values: - user - operator: in property: threats_active values: - true - operator: in property: severity values: - true - operator: in property: threat_category_group values: - malware - operator: in property: normalized_tag values: - finance - operator: in property: use_cases values: - data-transfer - operator: in property: is_genai values: - 'false' schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Zoom type: string app_category: description: Application category. example: collaboration type: string application_type: description: Type of application. example: web-based type: string edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 1678886400000 type: number is_genai: description: Is it a GenAI application. example: false type: boolean normalized_tag: description: Normalized tag. example: finance type: string platform_type: description: Platform type. example: prisma_access type: string risk_of_app: description: Risk level of the application. example: 0 type: integer security_service_type: description: Type of security service. enum: - url_filtering - threat_protection - wildfire example: url_filtering type: string severity: description: Severity of the threat. example: true type: boolean source_type: description: Source type. enum: - user - iot - other example: user type: string threat_category_group: description: Threat category group. example: malware type: string threats_active: description: Indicates if threats are active. example: true type: boolean use_cases: description: Use cases. example: data-transfer type: string type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: app_category: description: Application category. example: collaboration type: string total_data_usage: description: Total data usage in bytes. example: 1000000000.0 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get total data transfer per application tags: - Application API /insights/v3.0/resource/query/applications/internal/total_data_transfer_by_destination: post: description: Retrieves total data transfer by destination. This includes information such as destination and total bytes metrics. operationId: post-insights-v3.0-resource-query-applications-internal-total_data_transfer_by_destination parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: app values: - Box - operator: in property: app_category values: - general-internet - operator: in property: risk_of_app values: - 3 - operator: in property: edge_location_display_name values: - US West - operator: in property: platform_type values: - prisma_access - operator: in property: application_type values: - saas - operator: in property: security_service_type values: - url_filtering - operator: in property: source_type values: - user - operator: in property: threats_active values: - true - operator: in property: severity values: - critical - operator: in property: threat_category_group values: - malware - operator: in property: normalized_tag values: - finance - operator: in property: use_cases values: - data-loss-prevention - operator: in property: is_genai values: - true schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Box type: string app_category: description: Application category. example: general-internet type: string application_type: description: Application type. example: saas type: string edge_location_display_name: description: Prisma Access Location. example: US West type: string event_time: description: Time of the event. example: 5 type: number is_genai: description: Is it a GenAI application? true or false example: true type: boolean normalized_tag: description: Normalized tag. example: finance type: string platform_type: description: Platform type. example: prisma_access type: string risk_of_app: description: Risk of the application. example: 3 type: integer security_service_type: description: Security service type. It can be url_filtering, threat_protection, wildfire example: url_filtering type: string severity: description: Severity of the threat. example: critical type: string source_type: description: Source type. It can be user, iot, other example: user type: string threat_category_group: description: Threat category group. example: malware type: string threats_active: description: Are threats active? It can be true or false example: true type: boolean use_cases: description: Use cases. example: data-loss-prevention type: string type: object required: - event_time type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: destination: description: Destination of the data transfer. example: 192.168.1.1 type: string total_bytes: description: Total bytes transferred to the destination. example: 1000000.0 format: float type: number type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get total data transfer by destination tags: - Application API /insights/v3.0/resource/query/applications/pab/access_events: post: description: Retrieves the count of prisma access browser events for access classification category. operationId: post-insights-v3.0-resource-query-applications-pab-access_events parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - salesforce schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: salesforce type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get Access Events tags: - Application API /insights/v3.0/resource/query/applications/pab/access_events_breakdown: post: description: Retrieves the breakdown of type and the count of prisma access browser events for access classification category. operationId: post-insights-v3.0-resource-query-applications-pab-access_events_breakdown parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - zoom - salesforce schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: zoom type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: pab_event_count: description: PAB event count example: 10 type: integer type: description: Type of event example: File Open type: string type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get Access Events Breakdown tags: - Application API /insights/v3.0/resource/query/applications/pab/access_events_breakdown_blocked_histogram: post: description: Access Events Breakdown Blocked Histogram operationId: post-insights-v3.0-resource-query-applications-pab-access_events_breakdown_blocked_histogram parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - zoom histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: zoom type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object histogram: properties: enableEmptyInterval: description: Whether to include empty intervals in the histogram. example: true type: boolean property: description: The property to create a histogram for. example: event_time type: string range: description: The range for the histogram. example: minute type: string value: description: The value for the histogram range. example: 30 type: integer type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time example: 1709226000000 type: number pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get access events breakdown blocked histogram tags: - Application API /insights/v3.0/resource/query/applications/pab/data_events: post: description: Retrieves the count of prisma access browser events for data classification category. operationId: post-insights-v3.0-resource-query-applications-pab-data_events parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - zoom - salesforce schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: zoom type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get Data Events tags: - Application API /insights/v3.0/resource/query/pab/access_events_blocked: post: description: 'Retrieve the number of blocked Prisma Access Browser events for access classification categories. ' operationId: post-insights-v3.0-resource-query-pab-access_events_blocked parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - outlook schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: outlook type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Type of platform. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Blocked Access Events Data tags: - Application API /insights/v3.0/resource/query/pab/access_events_blocked_histogram: post: description: 'Retrieve a histogram of blocked Prisma Access Browser events for access classification categories. ' operationId: post-insights-v3.0-resource-query-pab-access_events_blocked_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - box histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: box type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Type of platform. example: prisma_access type: string transformed_user_name: description: User name. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time example: 1709226000000 type: number pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Blocked Access Events Histogram Data tags: - Application API /insights/v3.0/resource/query/pab/access_events_breakdown_blocked: post: description: 'Retrieve a breakdown of blocked Prisma Access Browser events by type and access classification categories. ' operationId: post-insights-v3.0-resource-query-pab-access_events_breakdown_blocked parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - gmail schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: gmail type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Type of platform. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: pab_event_count: description: PAB event count example: 10 type: integer type: description: Type of event example: File Open type: string type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Blocked Access Events Breakdown Data tags: - Application API /insights/v3.0/resource/query/pab/access_events_breakdown_histogram: post: description: 'Retrieve a histogram of Prisma Access Browser events breakdown by type and access classification categories. ' operationId: post-insights-v3.0-resource-query-pab-access_events_breakdown_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - salesforce histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: salesforce type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: User name. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time example: 1709226000000 type: number pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Access Events Breakdown Histogram Data tags: - Application API /insights/v3.0/resource/query/pab/access_events_histogram: post: description: 'Retrieve a histogram of Prisma Access Browser events by type and access classification categories. ' operationId: post-insights-v3.0-resource-query-pab-access_events_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - zoom - salesforce histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: zoom type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time example: 1709226000000 type: number pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Access Events Histogram Data tags: - Application API /insights/v3.0/resource/query/pab/data_events_blocked: post: description: Retrieves the count of prisma access browser events for data classification category and if the event is blocked. operationId: post-insights-v3.0-resource-query-pab-data_events_blocked parameters: - description: Region mapping for the tenant. in: header name: X-PANW-Region required: true schema: example: americas type: string - description: A Prisma-Tenant is a unique identifier for a tenant or a subtenant within a single or multi-tenant architecture, providing precise tenant management and resource allocation. in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - Zoom - Slack schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Zoom type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Get Data Events Blocked tags: - Application API /insights/v3.0/resource/query/pab/data_events_blocked_histogram: post: description: 'Retrieve a histogram of blocked Prisma Access Browser events for data classification categories. ' operationId: post-insights-v3.0-resource-query-pab-data_events_blocked_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - Zoom histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Zoom type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time example: 1709226000000 type: number pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Blocked Data Events Histogram Data tags: - Application API /insights/v3.0/resource/query/pab/data_events_breakdown: post: description: 'Retrieve a breakdown of Prisma Access Browser events by type and data classification categories. ' operationId: post-insights-v3.0-resource-query-pab-data_events_breakdown parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - Zoom - Slack schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Zoom type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: pab_event_count: description: PAB event count example: 10 type: integer type: description: Type of event example: File Open type: string type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Data Events Breakdown tags: - Application API /insights/v3.0/resource/query/pab/data_events_breakdown_blocked: post: description: 'Retrieve a breakdown of blocked Prisma Access Browser events by type and data classification categories. ' operationId: post-insights-v3.0-resource-query-pab-data_events_breakdown_blocked parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - ngfw - operator: in property: app values: - gmail schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: gmail type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: Username. example: test_user type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: pab_event_count: description: PAB event count example: 10 type: integer type: description: Type of event example: File Open type: string type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Blocked Data Events Breakdown tags: - Application API /insights/v3.0/resource/query/pab/data_events_breakdown_blocked_histogram: post: description: 'Retrieve a histogram of blocked data events breakdown. ' operationId: post-insights-v3.0-resource-query-pab-data_events_breakdown_blocked_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - Zoom histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Zoom type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Platform type. example: prisma_access type: string transformed_user_name: description: User name. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time example: 1709226000000 type: number pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Blocked Data Events Histogram tags: - Application API /insights/v3.0/resource/query/pab/data_events_breakdown_histogram: post: description: 'Retrieve a histogram of data events breakdown by type and data classification categories. ' operationId: post-insights-v3.0-resource-query-pab-data_events_breakdown_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - Zoom histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: Zoom type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Type of platform. example: prisma_access type: string transformed_user_name: description: User name. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time example: 1709226000000 type: number pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Data Events Breakdown Histogram tags: - Application API /insights/v3.0/resource/query/pab/data_events_histogram: post: description: 'Retrieve a histogram of data events by type and data classification categories. ' operationId: post-insights-v3.0-resource-query-pab-data_events_histogram parameters: - description: 'Map the region for the tenant. ' in: header name: X-PANW-Region required: true schema: example: americas type: string - description: 'Use a unique Prisma-Tenant identifier for precise tenant management and resource allocation within single or multi-tenant architectures. ' in: header name: Prisma-Tenant required: false schema: example: 12345678:12345679 type: string requestBody: content: application/json: examples: With mandatory filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: platform_type values: - prisma_access histogram: enableEmptyInterval: true property: event_time range: minute value: 30 With possible filters: value: filter: rules: - operator: last_n_hours property: event_time values: - 5 - operator: in property: transformed_user_name values: - john.doe - operator: in property: platform_type values: - prisma_access - operator: in property: app values: - box histogram: enableEmptyInterval: true property: event_time range: minute value: 30 schema: properties: filter: properties: rules: items: properties: app: description: Application name. example: box type: string event_time: description: Time of the event. example: 5 type: number platform_type: description: Type of platform. example: prisma_access type: string transformed_user_name: description: Username. example: john.doe type: string type: object required: - event_time - platform_type type: array type: object type: object required: true responses: '200': content: application/json: schema: properties: event_time: description: Event time example: 1709226000000 type: number pab_event_count: description: PAB event count example: 10 type: integer type: object description: OK '400': description: Resource property is not valid '403': description: Permission Denied '404': description: Resource not found '500': description: Failed to process request security: - Bearer: [] summary: Data Events Histogram tags: - Application API components: securitySchemes: Bearer: scheme: bearer type: http