openapi: 3.2.0
info:
  title: Palo Alto Networks Audit Logs API
  version: '1.0'
  description: 'Operations tagged Audit Logs across 3 of this provider''s published API definitions: palo-alto-cspm-auditlogs-openapi.json, palo-alto-cspm-auditlogsmicroservice-openapi.json, palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: "As part of compliance requirement for organizations, companies need to demonstrate they are pro-actively \ntracking security issues and taking steps to remediate issues as they occur. Prisma Cloud Audit Logs \nsection enables companies to prepare for such audits and demonstrates compliance.\n"
  name: Audit Logs
paths:
  /audit/redlock:
    get:
      description: Returns audit logs for events that took place on the Prisma Cloud platform.
      operationId: rl-audit-logs
      x-public: 'true'
      parameters:
      - description: Time Type
        in: query
        name: timeType
        required: false
        schema:
          enum:
          - relative
          type: string
      - description: Time Amount
        in: query
        name: timeAmount
        required: false
        schema:
          format: int32
          type: integer
      - description: Time Unit
        in: query
        name: timeUnit
        required: false
        schema:
          enum:
          - minute
          - hour
          - day
          - week
          - month
          - year
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/RedLockAuditLogBeanModel'
                type: array
          description: successful operation
        '400':
          description: bad_request
        '413':
          description: too_many_matching_results_reduce_time_range
      security:
      - x-redlock-auth: []
      summary: Prisma Cloud Audit Logs
      tags:
      - Audit Logs
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /audit/api/v1/log:
    post:
      tags:
      - Audit Logs
      summary: Get Audit Logs
      description: "Retrieves paginated audit logs based on the provided filter criteria.\n\n#### Rate Limits ####\n\nThe following rate limits apply:\n* Request rate limit: 10/sec \n* Burst limit: 10/sec \n"
      operationId: getAuditLogs
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditLogFilterRequest'
        required: true
      responses:
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '200':
          description: Successful Operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogViewResponse'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
      security:
      - x-redlock-auth: []
      x-migrated-v3: 'true'
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /audit/api/v1/filter/suggest:
    post:
      tags:
      - Audit Logs
      summary: Get Filter Suggestions
      description: "Get UI Filter Suggestions for Resource Types and User\n\n#### Rate Limits ####\n\nThe following rate limits apply:\n* Request rate limit: 10/sec \n* Burst limit: 10/sec \n"
      operationId: getResourceTypes
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AuditLogFilterSuggestRequest'
        required: true
      responses:
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
        '200':
          description: Successful Operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogFilterSuggestion'
        '429':
          description: Too Many Requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/V2ApiErrorResponse'
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
components:
  schemas:
    RedLockAuditLogBeanModel:
      description: Model for RedLockAuditLogBean
      properties:
        action:
          type: string
        actionType:
          description: Action Type
          type: string
        ipAddress:
          description: IP Address
          type: string
        resourceName:
          type: string
        resourceType:
          type: string
        result:
          type: string
        timestamp:
          description: Timestamp
          format: int64
          type: integer
        user:
          description: User
          type: string
      type: object
    AuditLogViewResponse:
      type: object
      properties:
        value:
          type: array
          description: The list of audit logs that match the request
          items:
            $ref: '#/components/schemas/AuditLogGetViewModel'
        nextPageToken:
          type: string
          description: The token to use to retrieve the next page of results
    RelativeTimeRangeValue:
      required:
      - amount
      - unit
      type: object
      properties:
        amount:
          type: integer
          description: Time Amount for 'relative' Time Range
          format: int32
        unit:
          type: string
          description: Time Unit for 'relative' Time Range. 'login' not supported here
          enum:
          - minute
          - hour
          - day
          - week
          - month
          - year
      description: Object holds 'amount' and 'unit' for 'relative' Time Range
    AuditLogFilterSuggestRequest:
      title: Audit Log Filter Suggest Request
      required:
      - filterName
      type: object
      properties:
        filterName:
          type: string
          description: The name of the filter
          example: resourceType
        query:
          type: string
          description: Case-insensitive query to suggest filter values.  Includes only items that contain the query as a substring.
          example: Login
    AuditLogFilterRequest:
      title: Audit Log Filter Request
      required:
      - timeRange
      type: object
      properties:
        timeRange:
          $ref: '#/components/schemas/TimeRange'
        filters:
          type: array
          description: List of audit log filters
          items:
            $ref: '#/components/schemas/AuditLogFilter'
        limit:
          type: integer
          description: 'The maximum number of results to return per page. Valid Range: [100, 500]'
          format: int32
          default: 500
        nextPageToken:
          type: string
          description: The optional token to retrieve the next page of results
    AuditLogFilterSuggestion:
      title: Audit Log Filter Suggestion
      type: object
      properties:
        suggestions:
          uniqueItems: true
          type: array
          description: List of Suggestions
          items:
            type: string
            description: List of Suggestions
        queryRemainder:
          type: string
          description: Query Remainder
    AuditLogGetViewModel:
      type: object
      properties:
        timestamp:
          type: integer
          description: The time stamp of the log entry
          format: int64
          example: 1623733133000
        action:
          type: string
          example: User foo@boo.com logged in via password
        ipAddress:
          type: string
          description: The IP address of associated with the performed the action
          example: 127.0.0.1
        actionType:
          type: string
          description: Represents the type of action performed on a resource by a given user or system
          example: LOGIN
          enum:
          - CREATE
          - READ
          - UPDATE
          - DELETE
          - LOGIN
        resourceName:
          type: string
          description: The name of the resource associated with the action
          example: foo@boo.com
        resourceType:
          type: string
          description: The type of the resource associated with the action
          example: Login
        result:
          type: string
          description: The result of the action performed
          example: Success
        user:
          type: string
          description: The user associated with the action
          example: foo@boo.com
      description: The list of audit logs that match the request
    V2ApiErrorResponse:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/Error'
      description: Represents the error encountered while processing the request
    AbsoluteTimeRangeValue:
      required:
      - startTime
      type: object
      properties:
        startTime:
          type: integer
          description: Start Time for 'absolute' Time Range
          format: int64
        endTime:
          type: integer
          description: End Time for 'absolute' Time Range
          format: int64
      description: Object holds 'startTime' and 'endTime' for 'absolute' Time Range
    Error:
      required:
      - code
      - message
      type: object
      properties:
        code:
          type: string
          description: 'Error Codes: BadRequest(400), Unauthorized(401), Forbidden(403), TooManyRequests(429).'
        message:
          type: string
          description: A human-readable representation of the error.
        target:
          type: string
          description: The target of the error
        details:
          type: array
          description: An array of details about specific errors that led to this reported error
          items:
            $ref: '#/components/schemas/Error'
      description: The actual error object
    TimeRange:
      required:
      - type
      - value
      type: object
      properties:
        type:
          type: string
          description: Time Type
          enum:
          - relative
          - absolute
          - to_now
        value:
          type: object
          description: Time Range Value
          oneOf:
          - $ref: '#/components/schemas/RelativeTimeRangeValue'
          - $ref: '#/components/schemas/AbsoluteTimeRangeValue'
          - title: ToNowTimeRangeValue
            type: string
            description: Represents a 'to_now' time type value.
            enum:
            - login
      description: The time range for the audit log filter
      discriminator:
        propertyName: type
    AuditLogFilter:
      type: object
      properties:
        name:
          type: string
        value:
          type: string
      description: List of audit log filters
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
x-refined-from:
- palo-alto-cspm-auditlogs-openapi.json
- palo-alto-cspm-auditlogsmicroservice-openapi.json
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json