openapi: 3.2.0
info:
  contact: {}
  description: "Access Keys are a secure way to enable programmatic access to the Prisma Cloud API. By default, only \nthe System Admin has API access and can enable API access for other administrators. If you have API access, \nyou can create up to two access keys. Create an access key for a limited time period and regenerate your API \nkeys periodically to minimize exposure and follow security best practices.\n"
  title: Prisma Cloud Access Keys API Overview Cloud Accounts API
  version: Latest
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
tags:
- description: "To begin monitoring the resources on your cloud infrastructure, you must first connect your public cloud \naccounts to Prisma™ Cloud. When you add your cloud account to Prisma Cloud, the API integration between \nyour cloud infrastructure provider and Prisma Cloud is established and you can begin monitoring the resources \nand identify potential security risks in your infrastructure.\n"
  name: Cloud Accounts
paths:
  /cloud:
    get:
      description: Lists all cloud accounts onboarded onto the Prisma Cloud platform.
      operationId: get-cloud-accounts
      parameters:
      - description: true = Exclude account group details. Default is false.
        in: query
        name: excludeAccountGroupDetails
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountViewModel'
                type: array
          description: successful operation
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Cloud Accounts
      tags:
      - Cloud Accounts
  /cloud/name:
    get:
      description: Returns a list of cloud account IDs and names.
      operationId: get-cloud-account-names
      parameters:
      - description: Returns IDs and names of active accounts only. Default is false.
        in: query
        name: onlyActive
        required: false
        schema:
          type: boolean
      - description: Returns IDs and names of accounts that belong to the specified account group IDs
        explode: true
        in: query
        name: accountGroupIds
        required: false
        schema:
          items:
            type: string
          type: array
      - description: Returns IDs and names of accounts that belong to the specified cloudType and accountGroup
        in: query
        name: cloudType
        required: false
        schema:
          type: string
      - description: Returns none cloudAccount and none cloudAccountId in response if includeOthers is true
        in: query
        name: includeOthers
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountIdentity'
                type: array
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List Cloud Account Names - GET
      tags:
      - Cloud Accounts
    post:
      description: Returns a list of cloud account IDs and names.
      operationId: get-cloud-account-names-by-post
      parameters:
      - description: Returns IDs and names of active accounts only. Default is false.
        in: query
        name: onlyActive
        required: false
        schema:
          type: boolean
      - description: Returns IDs and names of accounts that belong to the specified cloudType and accountGroup
        in: query
        name: cloudType
        required: false
        schema:
          type: string
      - description: Returns none cloudAccount and none cloudAccountId in response if includeOthers is true
        in: query
        name: includeOthers
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccountListRequestModel'
        description: Cloud Account Groups
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountIdentity'
                type: array
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List Cloud Account Names - POST
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}/{id}/project:
    get:
      description: Lists all cloud accounts onboarded onto the Prisma Cloud platform as children of an organization.
      operationId: get-cloud-org-accounts
      parameters:
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: true = Exclude account group details. Default is false.
        in: query
        name: excludeAccountGroupDetails
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountViewModel'
                type: array
          description: successful operation
        '400':
          description: not_found / not_an_org
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Cloud Org Accounts
      tags:
      - Cloud Accounts
  /cloud/type:
    get:
      description: Returns all the cloud types.
      operationId: get-cloud-types
      parameters:
      - description: '**true** = return only cloud types to which the user has access and for which he has onboarded cloud accounts. Default is **false**.'
        in: query
        name: onlyAccessible
        required: false
        schema:
          type: boolean
      - description: returns other cloudType in response if includeOthers is true
        in: query
        name: includeOthers
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  type: string
                type: array
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List Cloud Types
      tags:
      - Cloud Accounts
  /cloud/{id}/owners:
    get:
      description: Returns the email addresses of all owners for the specified cloud account ID.
      operationId: get-cloud-account-owners
      parameters:
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  type: string
                type: array
          description: successful operation
        '400':
          description: invalid_account_id_format
        '404':
          description: invalid_account_id_format
      security:
      - x-redlock-auth: []
      summary: List Cloud Account Owners
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}:
    post:
      description: "Onboard a new cloud account onto the Prisma Cloud platform.  \n\nThe request body parameters differ depending on the cloud type of the account you want to add.\n### Request Body to Add an AWS Account\nThe table below lists the request body parameters to add an AWS account.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\nenabled | boolean | Whether or not the account is enabled | Default is **false**\nexternalId | string | AWS account external ID | Required\ngroupIds | array of strings  | List of account group IDs for this account  | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\nroleArn | string | Unique identifier for an AWS resource (ARN) | Required\nprotectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is **MONITOR**\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"enabled\": true,\n  \"externalId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"roleArn\": \"\",\n  \"protectionMode\": \"MONITOR\"\n}\n```\n### Request Body to Add an AWS Org Account\nThe table below lists the request body parameters to add an AWS org account.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\nenabled | boolean | Whether or not the account is enabled | Default is **false**\nexternalId | string | AWS account external ID | Required\ngroupIds | array  | List of account group IDs for account  | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\nroleArn | string | Unique identifier for an AWS resource (ARN) | Required\naccountType | string | **organization** | Required\nmemberRoleName | string | AWS Member account role name | Required\nmemberExternalId | string | AWS Member account role's external ID | Required\nmemberRoleStatus | boolean | **true**: The member role created using stack set exists in all the member accounts. All the Org accounts will be added.<br/>**false**: Only the master account will be added. | Default is **false**\nprotectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is **MONITOR**\nhierarchySelection | array of objects | List of AWS Organization Units (OU), AWS accounts, and AWS Organizations to onboard under this organization | Default is none\nhierarchySelection.resourceId | string | Resource ID. Valid values are AWS OU ID, AWS account ID, or AWS Organization ID.<br/>Note you must escape any double quotes in the resource ID with a backslash. | Required if **hierarchySelection** is specified\nhierarchySelection.displayName | string | Display name for AWS OU, AWS account, or AWS organization | Required if **hierarchySelection** is specified\nhierarchySelection.nodeType | string | Valid values: **OU**, **ACCOUNT**, **ORG** |  Required if **hierarchySelection** is specified\nhierarchySelection.selectionType | string | Valid values: **INCLUDE** to include the specified resource to onboard, **EXCLUDE** to exclude the specified resource and onboard the rest, **ALL** to onboard all resources in the organization. |  Required if **hierarchySelection** is specified\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"enabled\": true,\n  \"externalId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"roleArn\": \"\",\n  \"accountType\": \"organization\",\n  \"memberRoleName\": \"\",\n  \"memberExternalId\": \"\",\n  \"memberRoleStatus\": true,\n  \"protectionMode\": \"MONITOR\",\n  \"hierarchySelection\": \n  [{\n    \"resourceId\": \"\",\n    \"displayName\": \"\",\n    \"nodeType\": \"OU\",\n    \"selectionType\": \"EXCLUDE\"\n  }]  \n}\n```\n\n### Request Body to Add an Azure Subscription\nThe table below lists the request body parameters to add an Azure subscription.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | Azure account ID | Required\ncloudAccount.enabled | boolean  | Whether or not to enable the account | Default is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account  | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\ncloudAccount.accountType | string | Valid value: **account** | Default is **account**\ncloudAccount.protectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs | Required\nkey | string | Application ID key | Required\nenvironmentType | string | Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"accountType\": \"account\",\n    \"protectionMode\": \"MONITOR\"\n  },\n  \"clientId\": \"\",\n  \"key\": \"\",\n  \"monitorFlowLogs\": true,\n  \"tenantId\": \"\",\n  \"servicePrincipalId\": \"\",\n  \"environmentType\": \"azure\"\n}\n```\n\n### Request Body to Add an Azure Tenant\nThe table below lists the request body parameters to add an Azure tenant without management groups.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | **cloudAccount.accountId** should be \"\" (empty)| Must be empty\ncloudAccount.enabled | boolean  | Whether or not to enable the account | Default is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account  | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.accountType | string | Valid value: **tenant** | Required\ncloudAccount.protectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is **MONITOR_AND_PROTECT**\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs | Required\nkey | string | Application ID key | Required\nenvironmentType | string | Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"accountType\": \"tenant\",\n    \"protectionMode\": \"MONITOR\"\n  },\n  \"clientId\": \"\",\n  \"key\": \"\",\n  \"monitorFlowLogs\": true,\n  \"tenantId\": \"\",\n  \"servicePrincipalId\": \"\",\n  \"environmentType\": \"azure\"\n}\n```\n\n### Request Body to Add an Azure Tenant with Management Groups\nThe table below lists the request body parameters to add an Azure tenant plus management groups and subscriptions \nassociated with that tenant.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | Must be set to \"\" (empty)| Must be empty\ncloudAccount.enabled | boolean  | Whether or not to enable the account | Default is **false**\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.accountType | string | Valid value: **tenant** | Required\ncloudAccount.protectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is **MONITOR_AND_PROTECT**\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs | Required\nkey | string | Application ID key | Required\nenvironmentType | string | Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\ndefaultAccountGroupId | string | Account group ID for this tenant. Used for alert rules. | Required\nrootSyncEnabled | boolean | **true** = Azure tenant has children. Must be set to **true**. | Required\nhierarchySelection | array of objects | List of subscriptions and/or management groups to onboard | Default is none\nhierarchySelection.resourceId | string | Management group ID or subscription ID.<br/>Note you must escape any double quotes in the resource ID with a backslash. | Required if **hierarchySelection** is specified\nhierarchySelection.displayName | string | Display name for management group or subscription | Required if **hierarchySelection** is specified\nhierarchySelection.nodeType | string | Valid values: **SUBSCRIPTION**, **TENANT**, **MANAGEMENT_GROUP** | Required if **hierarchySelection** is specified\nhierarchySelection.selectionType | string | Valid values: **INCLUDE** to include the specified resource to onboard, **EXCLUDE** to exclude the specified resource and onboard the rest, **ALL** to onboard all resources in the tenant. |  Required if **hierarchySelection** is specified      \n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"enabled\": true,\n    \"name\": \"\",\n    \"accountType\": \"tenant\",\n    \"protectionMode\": \"MONITOR_AND_PROTECT\"\n  },\n  \"clientId\": \"\",\n  \"key\": \"\",\n  \"monitorFlowLogs\": true,\n  \"tenantId\": \"\",\n  \"servicePrincipalId\": \"\",\n  \"environmentType\": \"azure\",\n  \"defaultAccountGroupId\": \"\",\n  \"rootSyncEnabled\": true,\n  \"hierarchySelection\":[{\n    \"displayName\":\"Tenant Root Group\",\n    \"nodeType\":\"TENANT\",\n    \"resourceId\":\"\",\n    \"selectionType\":\"INCLUDE\"\n  }]\n}\n```        \n\n### Request Body to Add a GCP Project\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | GCP project ID | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.enabled | boolean  | Whether or not the account is enabled | Defaults is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account | Required\ncloudAccount.projectId | string  | Existing GCP project ID | Required\ncloudAccount.protectionMode | string  | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required \ncloudAccount.accountType | string | Valid value: **account** | Required\ncredentials | JSON object | Service account key | Required\ncompressionEnabled |boolean | Enable flow log compression | Default is **false**\ndataflowEnabledProject | string | GCP project for flow log compression | Required if **compressionEnabled** is **true**\nflowLogStorageBucket | string | GCP flow logs storage bucket | Default is \"\"\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"accountType\": \"account\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"projectId\":\"\",\n    \"protectionMode\": \"MONITOR\"\n},\n\"compressionEnabled\": true,\n\"dataflowEnabledProject\": \"\",\n\"flowLogStorageBucket\": \"\",\n\"credentials\": {\n  \"type\": \"\",\n  \"project_id\": \"\",\n  \"private_key_id\": \"\",\n  \"private_key\": \"\",\n  \"client_email\": \"\",\n  \"client_id\": \"\",\n  \"auth_uri\": \"\",\n  \"token_uri\": \"\",\n  \"auth_provider_x509_cert_url\": \"\",\n  \"client_x509_cert_url\": \"\"\n}\n```\n\n### Request Body to Add a GCP Org\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | GCP Org ID | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.enabled | boolean  | Whether or not the account is enabled | Default is **false**\ncloudAccount.protectionMode | string  | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required \ncloudAccount.accountType | string | Valid value: **organization** | Required\ncredentials | JSON object | Service account key | Required\ncompressionEnabled |boolean | Enable flow log compression | Default is **false**\ndataflowEnabledProject | string | GCP project for flow log compression | Required if **compressionEnabled** is **true**\nflowLogStorageBucket | string | GCP flow logs storage bucket | Default is \"\"\norganizationName | string | GCP organization name | Required \naccountGroupCreationMode | string | Cloud account group creation mode. Valid values:<br/>**MANUAL**: Create account groups manually<br/>**AUTO**: Create high-level account groups based on folders identified<br/>**RECURSIVE**: Drill down in folder tree to create account groups | Default is **MANUAL**\ndefaultAccountGroupId | string | Account group ID for this account. Used for alert rules. | Required if **accountGroupCreationMode** is **MANUAL** \nhierarchySelection | array of objects | List of folders and/or projects to onboard under this organization | Default is none\nhierarchySelection.resourceId | string | Resource ID. For folders, format is _folders/{folder ID}_. For projects, format is _{project number}_. For orgs, format is _organizations/{org ID}_ | Required if **hierarchySelection** is specified\nhierarchySelection.displayName | string | Display name for folder, project, or organization | Required if **hierarchySelection** is specified\nhierarchySelection.nodeType | string | Valid values: **FOLDER**, **PROJECT**, **ORG** |  Required if **hierarchySelection** is specified\nhierarchySelection.selectionType | string | Valid values: **INCLUDE**, **EXCLUDE**, **INCLUDE ALL**. If **hierarchySelection.nodeType** is **PROJECT** or **FOLDER**, valid values are  **INCLUDE**, **EXCLUDE**. |  Required if **hierarchySelection** is specified\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"accountType\": \"organization\",\n    \"proectionMode\": \"MONITOR\"\n    \"enabled\": true,       \n    \"name\": \"\"\n},\n\"accountGroupCreationMode\": \"MANUAL\"\n\"compressionEnabled\": true,\n\"dataflowEnabledProject\": \"\",\n\"flowLogStorageBucket\": \"\",\n\"organizationName\": \"\",\n\"defaultAccountGroupId\": \"\",\n\"credentials\": {\n  \"type\": \"\",\n  \"project_id\": \"\",\n  \"private_key_id\": \"\",\n  \"private_key\": \"\",\n  \"client_email\": \"\",\n   \"client_id\": \"\",\n  \"auth_uri\": \"\",\n  \"token_uri\": \"\",\n  \"auth_provider_x509_cert_url\": \"\",\n  \"client_x509_cert_url\": \"\"\n},\n\"hierarchySelection\": \n  [{\n    \"resourceId\": \"\",\n    \"displayName\": \"\",\n    \"nodeType\": \"FOLDER\",\n    \"selectionType\": \"EXCLUDE\"\n  }]    \n}\n```\n\n### Request Body to Add a GCP Master Service Account\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | GCP project ID | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.enabled | boolean  | Whether or not the account is enabled | Default is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account | Required\ncloudAccount.projectId | string  | Existing GCP project ID | Required\ncloudAccount.protectionMode | string  | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required \ncloudAccount.accountType | string | Valid value: **masterServiceAccount** | Required\ndefaultAccountGroupId | string | Account group ID for this account. Used for alert rules. |  Required \ncredentials | JSON object | Service account key | Required\ncompressionEnabled |boolean | Enable flow log compression | Default is **false**\ndataflowEnabledProject | string | GCP project for flow log compression | Required if **compressionEnabled** is **true**\nflowLogStorageBucket | string | GCP flow logs storage bucket | Default is \"\"\n\n##### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"accountType\": \"masterServiceAccount\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"projectId\":\"\",\n    \"protectionMode\": \"MONITOR\"\n},\n\"compressionEnabled\": true,\n\"dataflowEnabledProject\": \"\",\n\"flowLogStorageBucket\": \"\",\n\"organizationName\": \"\",\n\"credentials\": {\n  \"type\": \"\",\n  \"project_id\": \"\",\n  \"private_key_id\": \"\",\n  \"private_key\": \"\",\n  \"client_email\": \"\",\n  \"client_id\": \"\",\n   \"auth_uri\": \"\",\n  \"token_uri\": \"\",\n  \"auth_provider_x509_cert_url\": \"\",\n  \"client_x509_cert_url\": \"\"\n}\n```\n\n### Request Body to Add an Alibaba Account\nThe table below lists the request body parameters to add an Alibaba account.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\ngroupIds | array of strings  | List of account group IDs for this account  | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\nroleArn | string | Unique identifier for an Alibaba RAM role resource | Required\nenabled | boolean | Whether or not the account is enabled | Default is **false**\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"enabled\": true,\n  \"ramArn\": \"\"\n}\n```\n### Requirements and Request Body to Add an OCI Account\nTo add an Oracle Cloud Infrastructure (OCI) account, you must:\n\n1. Use [Generate Zipped Terraform Script (OCI)](/prisma-cloud/api/cspm/generateterraformscript) in the console | Required\n\n#### Request Body Example\n```json\n{\n  \"accountType\":\"tenant\",\n  \"defaultAccountGroupId\":\"\",\n  \"enabled\":true,\n  \"name\":\"\",\n  \"groupName\":\"\",\n  \"homeRegion\":\"\",\n  \"policyName\":\"\",\n  \"accountId\":\"\",\n  \"userName\":\"\",\n  \"userOcid\":\"\"\n}\n```\n"
      operationId: add-cloud-account
      parameters:
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      - description: true = Skip account status checks to improve response time
        in: query
        name: skipStatusChecks
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
        description: Cloud Account
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: duplicate_cloud_account_name / duplicate_cloud_account / invalid_account_id_format / duplicate_cloud_account_needs_upgrade / cannot_select_zero_account_groups / invalid_account_group_ids
        '404':
          description: invalid_account_type
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Add Cloud Account
      tags:
      - Cloud Accounts
  /cloud/oci/terraform:
    post:
      description: Generates a zipped Terraform template to help you onboard your Oracle Cloud Infrastructure account to Prisma Cloud. You can use this template in the OCI Tenant Console to get a User OCID. Note that the generated keys will be valid for 24 hours.
      operationId: generateterraformscript
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/TerraformProvisionerRequest'
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_parameter_value
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Generate Zipped Terraform Script (OCI)
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}/{id}:
    get:
      description: Returns top level information about the cloud account.
      operationId: get-cloud-account
      parameters:
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: true = Include account group info. Default is false.
        in: query
        name: includeGroupInfo
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/CloudAccountModel'
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: Cloud Account Info
      tags:
      - Cloud Accounts
    put:
      description: "Update information related to a cloud account.  \n\nThe request body parameters differ depending on the cloud type of the account you want to add.\n### Request Body to Update an AWS Account\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Required?\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\nenabled | boolean | Whether or not the account is enabled | Required\nexternalId | string | AWS account external ID | Required\ngroupIds | array of strings | List of account group IDs for this account  | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\nroleArn | string | Unique identifier for an AWS resource (ARN) | Required\nprotectionMode |string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"enabled\": true,\n  \"externalId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"roleArn\": \"\",\n  \"protectionMode\": \"MONITOR\"\n}\n```\n### Request Body to Update an AWS Org Account\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Required?\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\nenabled | boolean | Whether or not the account is enabled | Required\nexternalId | string | AWS account external ID | Required\ngroupIds | array of strings  | List of account group IDs for this account | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\nroleArn | string | Unique identifier for an AWS resource (ARN) | Required\naccountType | string | **organization** | Required\nmemberRoleName | string | AWS Member account role name | Required\nmemberExternalId | string | AWS Member account role's external ID | Required\nmemberRoleStatus | boolean | **true**: The member role created using stack set exists in all the member accounts. All the Org accounts will be added.<br/>**false**: Only the master account will be added. | Required\nprotectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required\nhierarchySelection | array of objects | List of AWS Organization Units (OU), AWS accounts, and AWS Organizations to onboard under this organization | Default is none\nhierarchySelection.resourceId | string | Resource ID. Valid values are AWS OU ID, AWS account ID, or AWS Organization ID.<br/>Note you must escape any double quotes in the resource ID with a backslash. | Required if **hierarchySelection** is specified\nhierarchySelection.displayName | string | Display name for AWS OU, AWS account, or AWS organization | Required if **hierarchySelection** is specified\nhierarchySelection.nodeType | string | Valid values: **OU**, **ACCOUNT**, **ORG** |  Required if **hierarchySelection** is specified\nhierarchySelection.selectionType | string | Valid values: **INCLUDE** to include the specified resource to onboard, **EXCLUDE** to exclude the specified resource and onboard the rest, **ALL** to onboard all resources in the organization. |  Required if **hierarchySelection** is specified\n\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"enabled\": true,\n  \"externalId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"roleArn\": \"\",\n  \"accountType\": \"organization\",\n  \"memberRoleName\": \"\",\n  \"memberExternalId\": \"\",\n  \"memberRoleStatus\": true,\n  \"protectionMode\": \"MONITOR\",\n  \"hierarchySelection\": \n  [{\n    \"resourceId\": \"\",\n    \"displayName\": \"\",\n    \"nodeType\": \"OU\",\n    \"selectionType\": \"EXCLUDE\"\n  }] \n}\n```\n\n### Request Body to Update an Azure Subscription\nThe table below lists the request body parameters to update an Azure subscription.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | Azure account ID | Required\ncloudAccount.enabled | boolean  | Whether or not to enable the account | Default is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account  | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\ncloudAccount.accountType | string | Valid value: **account** | Default is **account**\ncloudAccount.protectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is the existing value\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs | Required\nkey | string | Application ID key | Required\nenvironmentType | string | Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"accountType\": \"account\",\n    \"protectionMode\": \"MONITOR\"\n  },\n  \"clientId\": \"\",\n  \"key\": \"\",\n  \"monitorFlowLogs\": true,\n  \"tenantId\": \"\",\n  \"servicePrincipalId\": \"\",\n  \"environmentType\": \"azure\"\n}\n```\n\n### Request Body to Update an Azure Tenant\nThe table below lists the request body parameters to update an Azure tenant without management groups.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | **cloudAccount.accountId** should be \"\" (empty)| Must be empty\ncloudAccount.enabled | boolean  | Whether or not to enable the account | Default is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account  | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.accountType | string | Valid value: **tenant** | Required\ncloudAccount.protectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is the existing value\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs | Required\nkey | string | Application ID key | Required\nenvironmentType | string | Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"accountType\": \"tenant\",\n    \"protectionMode\": \"MONITOR\"\n  },\n  \"clientId\": \"\",\n  \"key\": \"\",\n  \"monitorFlowLogs\": true,\n  \"tenantId\": \"\",\n  \"servicePrincipalId\": \"\",\n  \"environmentType\": \"azure\"\n}\n```\n\n### Request Body to Update an Azure Tenant with Management Groups\nThe table below lists the request body parameters to update an Azure tenant plus management groups and subscriptions \nassociated with that tenant.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | Must be set to \"\" (empty)| Must be empty\ncloudAccount.enabled | boolean  | Whether or not to enable the account | Default is **false**\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.accountType | string | Valid value: **tenant** | Required\ncloudAccount.protectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is the existing value\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs | Required\nkey | string | Application ID key | Required\nenvironmentType | string | Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\ndefaultAccountGroupId | string | Account group ID for this tenant. Used for alert rules. | Required\nrootSyncEnabled | boolean | **true** = Azure tenant has children. Must be set to **true**. | Required\nhierarchySelection | array of objects | List of subscriptions and/or management groups to onboard | Default is none\nhierarchySelection.resourceId | string | Management group ID or subscription ID.<br/>Note you must escape any double quotes in the resource ID with a backslash. | Required if **hierarchySelection** is specified\nhierarchySelection.displayName | string | Display name for management group or subscription | Required if **hierarchySelection** is specified\nhierarchySelection.nodeType | string | Valid values: **SUBSCRIPTION**, **TENANT**, **MANAGEMENT_GROUP** | Required if **hierarchySelection** is specified\nhierarchySelection.selectionType | string | Valid values: **INCLUDE** to include the specified resource to onboard, **EXCLUDE** to exclude the specified resource and onboard the rest, **ALL** to onboard all resources in the tenant. |  Required if **hierarchySelection** is specified      \n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"enabled\": true,\n    \"name\": \"\",\n    \"accountType\": \"tenant\",\n    \"protectionMode\": \"MONITOR_AND_PROTECT\"\n  },\n  \"clientId\": \"\",\n  \"key\": \"\",\n  \"monitorFlowLogs\": true,\n  \"tenantId\": \"\",\n  \"servicePrincipalId\": \"\",\n  \"environmentType\": \"azure\",\n  \"defaultAccountGroupId\": \"\",\n  \"rootSyncEnabled\": true,\n  \"hierarchySelection\":[{\n    \"displayName\":\"Tenant Root Group\",\n    \"nodeType\":\"TENANT\",\n    \"resourceId\":\"\",\n    \"selectionType\":\"INCLUDE\"\n  }]\n}\n```  \n\n\n### Request Body to Update a GCP Project\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Required?\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | GCP project ID | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.enabled | boolean  | Whether or not the account is enabled | Required\ncloudAccount.groupIds | array of strings | List of account group IDs for this account | Required\ncloudAccount.projectId | string  | Existing GCP project ID | Required\ncloudAccount.protectionMode | string  | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required \ncloudAccount.accountType | string | Valid value for GCP project: **account** | Required\ncredentials | JSON object | Service account key | Required\ncompressionEnabled |boolean | Enable flow log compression | Optional\ndataflowEnabledProject | string | GCP project for flow log compression | Required if **compressionEnabled** is **true**\nflowLogStorageBucket | string | GCP flow logs storage bucket | Optional\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"accountType\": \"account\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"projectId\":\"\",\n    \"protectionMode\": \"MONITOR\"\n},\n\"compressionEnabled\": true,\n\"dataflowEnabledProject\": \"\",\n\"flowLogStorageBucket\": \"\",\n\"credentials\": {\n    \"type\": \"\",\n    \"project_id\": \"\",\n    \"private_key_id\": \"\",\n    \"private_key\": \"\",\n    \"client_email\": \"\",\n    \"client_id\": \"\",\n    \"auth_uri\": \"\",\n    \"token_uri\": \"\",\n    \"auth_provider_x509_cert_url\": \"\",\n    \"client_x509_cert_url\": \"\"\n}\n```\n\n### Request Body to Update a GCP Org\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Required?\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | GCP Org ID | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.enabled | boolean  | Whether or not the account is enabled | Optional\ncloudAccount.protectionMode | string  | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required \ncloudAccount.accountType | string | Valid value: **organization** | Required\ncredentials | JSON object | Service account key | Required\ncompressionEnabled |boolean | Enable flow log compression | Optional\ndataflowEnabledProject | string | GCP project for flow log compression | Required if **compressionEnabled** is **true**\nflowLogStorageBucket | string | GCP flow logs storage bucket | Optional\norganizationName | string | GCP organization name | Required \naccountGroupCreationMode | string | Cloud account group creation mode. Valid values:<br/>**MANUAL**: Create account groups manually<br/>**AUTO**: Create high-level account groups based on folders identified<br/>**RECURSIVE**: Drill down in folder tree to create account groups | Optional\ndefaultAccountGroupId | string | Account group ID for this account. Used for alert rules. |  Required if **accountGroupCreationMode** is **MANUAL** \nhierarchySelection | array of objects | List of folders and/or projects to onboard under this organization | Optional\nhierarchySelection.resourceId | string | Resource ID. For folders, format is _folders/{folder ID}_. For projects, format is _{project number}_. For orgs, _format is organizations/{org ID}_ | Required if **hierarchySelection** is specified\nhierarchySelection.displayName | string | Display name for folder, project, or organization | Required if **hierarchySelection** is specified\nhierarchySelection.nodeType | string | Valid values: **FOLDER**, **PROJECT**, **ORG** |  Required if **hierarchySelection** is specified\nhierarchySelection.selectionType | string | Valid values: **INCLUDE**, **EXCLUDE**, **INCLUDE ALL**. If **hierarchySelection.nodeType** is **PROJECT** or **FOLDER**, valid values are  **INCLUDE**, **EXCLUDE**. |  Required if **hierarchySelection** is specified\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"accountType\": \"organization\",\n    \"proectionMode\": \"MONITOR\"\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"projectId\":\"\",\n    \"protectionMode\": \"MONITOR\"\n},\n\"accountGroupCreationMode\": \"MANUAL\"\n\"compressionEnabled\": true,\n\"dataflowEnabledProject\": \"\",\n\"flowLogStorageBucket\": \"\",\n\"credentials\": {\n    \"type\": \"\",\n    \"project_id\": \"\",\n    \"private_key_id\": \"\",\n    \"private_key\": \"\",\n    \"client_email\": \"\",\n    \"client_id\": \"\",\n    \"auth_uri\": \"\",\n    \"token_uri\": \"\",\n    \"auth_provider_x509_cert_url\": \"\",\n    \"client_x509_cert_url\": \"\"\n},\n\"hierarchySelection\": \n  [{\n    \"resourceId\": \"\",\n    \"displayName\": \"\",\n    \"nodeType\": \"FOLDER\",\n    \"selectionType\": \"EXCLUDE\"\n  }]    \n}\n```\n\n### Request Body to Update a GCP Master Service Account\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Required?\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | GCP project ID | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.enabled | boolean  | Whether or not the account is enabled | Optional\ncloudAccount.groupIds | array of strings | List of account group IDs for this account | Required\ncloudAccount.projectId | string  | Existing GCP project ID | Required\ncloudAccount.protectionMode | string  | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required \ncloudAccount.accountType | string | Valid value: **masterServiceAccount** | Required\ndefaultAccountGroupId | string | Account group ID for this account. Used for alert rules. | Required \ncredentials | JSON object | Service account key | Required\ncompressionEnabled |boolean | Enable flow log compression | Optional\ndataflowEnabledProject | string | GCP project for flow log compression | Required if **compressionEnabled** is **true**\nflowLogStorageBucket | string | GCP flow logs storage bucket | Optional\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"accountType\": \"masterServiceAccount\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"projectId\":\"\",\n    \"protectionMode\": \"MONITOR\"\n},\n\"defaultAccountGroupId\": \"\",\n\"compressionEnabled\": true,\n\"dataflowEnabledProject\": \"\",\n\"flowLogStorageBucket\": \"\",\n\"credentials\": {\n    \"type\": \"\",\n    \"project_id\": \"\",\n    \"private_key_id\": \"\",\n    \"private_key\": \"\",\n    \"client_email\": \"\",\n    \"client_id\": \"\",\n    \"auth_uri\": \"\",\n    \"token_uri\": \"\",\n    \"auth_provider_x509_cert_url\": \"\",\n    \"client_x509_cert_url\": \"\"\n}\n```\n\n### Request Body to Update an Alibaba Account\nThe table below lists the request body parameters.\n\nParameter  | Type | Description |  Required?\n-----------| ---- | ----------- | -------------\naccountId |string | AWS account ID | Required\ngroupIds | array of strings  | List of account group IDs for this account  | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\nroleArn | string | Unique identifier for an Alibaba RAM role resource | Required\nenabled | boolean | Whether or not the account is enabled | Required\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"enabled\": true,\n  \"ramArn\": \"\"\n}\n```\n### Request Body to Update an OCI Account\nThe table below lists the request body parameters to add an OCI account.\n\nParameter  | Type | Description | Required?\n-----------| ---- | ----------- | -------------\naccountType | string | OCI Account type. Current valid value is **tenant**. | Required\ndefaultAccountGroupId | string | Account group ID for this account. Used for alert rules. |  Required\nenabled | boolean | Whether or not to enable the account |  Required\nname | string  | Name of the OCI tenant you want Prisma Cloud to monitor | Required\ngroupName | string | OCI identity group name that you define. Can be an existing group |  Required\nhomeRegion | string  | OCI tenancy home region |  Required\npolicyName | string  | OCI identity policy name that you define. Can be an existing policy that has the right policy statements. |  Required\naccountId | string  | OCID of your OCI tenancy | Required\nuserName | string  | OCI identity user name that you define. Can be an existing user that has the right privileges. |  Required\nuserOcid | string  | User OCID from your OCI Tenant Console after you apply the zip file from [Generate Zipped Terraform Script (OCI)](/prisma-cloud/api/cspm/generateterraformscript) in the console |  Required\n\n#### Request Body Example\n```json\n{\n  \"accountType\":\"tenant\",\n  \"defaultAccountGroupId\":\"\",\n  \"enabled\":true,\n  \"name\":\"\",\n  \"groupName\":\"\",\n  \"homeRegion\":\"\",\n  \"policyName\":\"\",\n  \"accountId\":\"\",\n  \"userName\":\"\",\n  \"userOcid\":\"\"\n}\n```      \n"
      operationId: update-cloud-account
      parameters:
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      - description: true = Skip account status checks to improve response time
        in: query
        name: skipStatusChecks
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
        description: Cloud Account
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_account_id_format / duplicate_cloud_account_name / duplicate_cloud_account / cannot_select_zero_account_groups / invalid_account_group_ids
        '404':
          description: invalid_account_type
        '500':
          description: not_found / internal_error
      security:
      - x-redlock-auth: []
      summary: Update Cloud Account
      tags:
      - Cloud Accounts
    delete:
      description: Deletes the onboarded cloud account that has the specified cloud account ID.
      operationId: delete-cloud-account
      parameters:
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_cloud_type / bad_request
        '403':
          description: cannot_delete_org_child
        '404':
          description: invalid_cloud_type / invalid_account_id_format
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Delete Cloud Account
      tags:
      - Cloud Accounts
    patch:
      description: Enable / disable cloud account (and children) OR Update the Account Groups it belongs to
      operationId: patch-cloud-account
      parameters:
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CloudAccountPatchModel'
        description: Cloud Account Patch
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_account_id_format / invalid_account_patch
        '404':
          description: invalid_cloud_type / invalid_account_id_format
        '405':
          description: cloud_account_already_enabled / cloud_account_already_disabled
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Patch Cloud Account
      tags:
      - Cloud Accounts
  /account/{accountId}/config/status:
    get:
      description: Returns a list of Prisma Cloud services whose status indicates a warning or error for the given cloud account ID. Includes status details for each listed service.
      operationId: list-cloud-account-status-details
      parameters:
      - description: Cloud account ID
        in: path
        name: accountId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountConfigStatusView'
                type: array
          description: successful operation
        '400':
          description: bad_request
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Account Status Details
      tags:
      - Cloud Accounts
  /cloud/status/{cloud_type}:
    post:
      description: "Lists status messages of the specified cloud account.  \n\nThis request performs a cloud account on-boarding trial run. You can use this request to validate your parameters before \nyou use [Add Cloud Account](/prisma-cloud/api/cspm/add-cloud-account).\n"
      operationId: get-cloud-account-status
      parameters:
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountStatus'
                type: array
          description: successful operation
        '400':
          description: bad_request
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Cloud Account Status
      tags:
      - Cloud Accounts
  /cloud/{id}/status/{enabled}:
    patch:
      description: Enable or disable cloud account.
      operationId: update-cloud-account-status
      parameters:
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: Status To Set
        in: path
        name: enabled
        required: true
        schema:
          type: boolean
      - description: Allows for updating status of children cloud accounts if any. Default is false.
        in: query
        name: updateChildren
        required: false
        schema:
          type: boolean
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_account_id_format / invalid_account_patch
        '404':
          description: invalid_account_id_format
      security:
      - x-redlock-auth: []
      summary: Update Cloud Account Status
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}/accounts/{account_id}/hierarchy:
    get:
      description: For GCP only. Get the previously saved resource hierarchy for the specified cloud account ID.
      operationId: get-previously-saved-resource-hierarchy
      parameters:
      - description: Cloud type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - gcp
          type: string
      - description: GCP account ID
        in: path
        name: account_id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/HierarchySelection'
          description: success
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Saved Resource Hierarchy (GCP)
      tags:
      - Cloud Accounts
  /cloud/gcp/parent/{parent_id}/children:
    post:
      description: "For GCP only. List all the children, both folder resources and project resources, of the given parent. A parent can be an organization resource or a folder resource.  \n\nThe request body parameter is the content of the Service Account Key (JSON) file, which is required.\n"
      operationId: get-list-of-children-under-parent
      parameters:
      - description: GCP parent resource ID
        in: path
        name: parent_id
        required: true
        schema:
          type: string
      - description: Token to request next page of projects
        in: query
        name: projectNextPageToken
        required: false
        schema:
          type: string
      - description: Page size for paging projects. Valid range is 1-300 inclusive. A page size of 0 returns a nextPageToken but no projects.
        in: query
        name: projectPageSize
        required: false
        schema:
          format: int32
          type: integer
      - description: Token to request next page of folders
        in: query
        name: folderNextPageToken
        required: false
        schema:
          type: string
      - description: Page size for paging folders. Valid range is 1-300 inclusive. A page size of 0 returns a nextPageToken but no folders.
        in: query
        name: folderPageSize
        required: false
        schema:
          format: int32
          type: integer
      - description: Parent type
        in: query
        name: parentType
        required: true
        schema:
          enum:
          - folders
          - organizations
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GcpResourceControllerRequestModel'
        description: The content of the credentials object is the Service Account Key for your Google Cloud service account
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/ListChildrenApiResponseModel'
          description: success
        '400':
          description: bad_request / unauthorized_access
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Children of Parent (GCP)
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}/parent/{parent_id}/folders:
    post:
      description: "For GCP only. List all the child folders of the given parent. A parent can be an organization resource or a folder resource.  \n\nThe request body parameter is the content of the Service Account Key (JSON) file, which is required.\n"
      operationId: get-list-of-folders-under-parent
      parameters:
      - description: Cloud type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - gcp
          type: string
      - description: GCP parent ID
        in: path
        name: parent_id
        required: true
        schema:
          type: string
      - description: Token to request next page of folders
        in: query
        name: nextPageToken
        required: false
        schema:
          type: string
      - description: Page size. Valid range is 1-300 inclusive. A page size of 0 returns a nextPageToken but no folders.
        in: query
        name: pageSize
        required: false
        schema:
          format: int32
          type: integer
      - description: Parent type
        in: query
        name: parentType
        required: true
        schema:
          enum:
          - folders
          - organizations
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GcpResourceControllerRequestModel'
        description: The content of the credentials object is the Service Account Key for your Google Cloud service account
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/GcpNodeModel'
          description: success
        '400':
          description: bad_request
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Folders of Parent (GCP)
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}/parent/{parent_id}/projects:
    post:
      description: "For GCP only. List all the child projects of the given parent. A parent can be an organization resource or a folder resource.  \n\nThe request body parameter is the content of the Service Account Key (JSON) file, which is required.\n"
      operationId: get-list-of-projects-under-parent
      parameters:
      - description: Cloud type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - gcp
          type: string
      - description: GCP parent ID
        in: path
        name: parent_id
        required: true
        schema:
          type: string
      - description: Token to request next page of projects
        in: query
        name: nextPageToken
        required: false
        schema:
          type: string
      - description: Page size. Valid range is 1-300 inclusive. A page size of 0 returns a nextPageToken but no projects.
        in: query
        name: pageSize
        required: false
        schema:
          format: int32
          type: integer
      - description: Parent type
        in: query
        name: parentType
        required: true
        schema:
          enum:
          - folders
          - organizations
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
        description: Service Account Key (JSON) file content
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/GcpNodeModel'
          description: success
        '400':
          description: bad_request / unauthorized_access
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Projects of Parent (GCP)
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}/accounts/{account_id}/ancestors:
    post:
      description: "For GCP only. Lists the ancestors of the given projects and folders for the specified cloud account ID. A successful response returns an array of projects and/or folders each of which is mapped to an array of ancestor resource IDs.  \n\nThe body parameters resourceIds are required.\n"
      operationId: get-ancestors-for-given-projects-folders
      parameters:
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - gcp
          type: string
      - description: Account ID
        in: path
        name: account_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Resources'
        description: Cloud service provider resource IDs
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/GcpNodeModel'
                type: array
                uniqueItems: true
          description: success
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Ancestors (GCP)
      tags:
      - Cloud Accounts
  /cloud-accounts-manager/v1/cloudAccounts/azureAccounts/{parent_id}/children:
    post:
      description: "For Azure only. Lists all the children, both management groups and subscriptions, under the given parent. A parent can be either an Azure tenant or a management group.  \n\n### Request Body\nThe table below lists the required request body parameters.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | Azure account ID | Required\ncloudAccount.accountType | string | Valid value: **tenant** | Required\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nkey | string | Application ID key | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs. Must be **true**. | Required\nenvironmentType | string | Existing environment type. Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\nrootSyncEnabled | boolean | **true** = Azure tenant has children. Must be **true**. | Required\n\n#### Request Body Example\n```json\n{\n  \"clientId\":\"\",\n  \"cloudAccount\": {\n    \"accountId\":\"\",\n    \"accountType\":\"tenant\"\n  },\n  \"environmentType\":\"azure\",\n  \"key\":\"\",\n  \"monitorFlowLogs\":true,\n  \"rootSyncEnabled\":true,\n  \"servicePrincipalId\":\"\",\n  \"tenantId\":\"\"\n}\n```      \n"
      operationId: list-children-under-parent
      parameters:
      - description: Parent Resource ID
        in: path
        name: parent_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
        description: Azure cloud account parameters
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/AzureHierarchyNodeModel'
                type: array
          description: success
        '400':
          description: bad_request / unauthorized_access
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Children of Parent (Azure)
      tags:
      - Cloud Accounts
  /cloud-accounts-manager/v1/cloudAccounts/azureAccounts/{account_id}/ancestors:
    post:
      description: For Azure only. Lists the ancestors of the given Azure management groups and subscriptions for the specified cloud account (Azure tenant) ID. Each resource ID in the request body is either a management group ID or a subscription ID. A successful response returns an array of ancestors for each given resource ID.
      operationId: get-ancestors-for-given-subscriptions-and-management-groups
      parameters:
      - description: Account ID
        in: path
        name: account_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Resources'
        description: Cloud service provider resource IDs
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/AzureAncestorsModel'
                type: array
                uniqueItems: true
          description: success
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Ancestors (Azure)
      tags:
      - Cloud Accounts
  /dlp/api/v1/config/awsorg/status:
    post:
      description: Returns whether or not the set up for your AWS Organization meets the prerequisites for successful creation of a data security configuration.
      operationId: get-status-for-org
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/AWSOrgStatusConfigModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AWSOrgStatusResponseModel'
          description: success
        '400':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/DLPAPIResponse'
          description: bad_request
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Check Data Security Preconditions (AWS Org)
      tags:
      - Cloud Accounts
  /dlp/api/config/v2:
    post:
      description: Creates a data security configuration for an AWS Organization.
      operationId: onboard-aws-org-scan
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/AWSOrgRequestConfigModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/DLPAPIResponse'
          description: success
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Add Data Security Config (AWS Org)
      tags:
      - Cloud Accounts
    put:
      description: Updates the data security configuration for the AWS Organization with the specified account ID.
      operationId: update-aws-org-scan-config
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/AWSOrgRequestConfigModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/DLPAPIResponse'
          description: success
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Update Data Security Config (AWS Org)
      tags:
      - Cloud Accounts
  /dlp/api/config/v2/{accountId}:
    get:
      description: Returns the data security configuration for the AWS Organization with the specified account ID.
      operationId: get-aws-org-scan-details
      parameters:
      - description: AWS account ID
        in: path
        name: accountId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AWSOrgConfig'
          description: success
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Data Security Config (AWS Org)
      tags:
      - Cloud Accounts
  /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{parent_id}/children:
    post:
      description: For AWS only. Lists all the children of the given parent organizational unit (OU).The listed children include both OU resources and account resources.
      operationId: get-list-of-children-under-parent-aws-legacy
      parameters:
      - description: Parent OU ID
        in: path
        name: parent_id
        required: true
        schema:
          type: string
      - description: The page token to request the next page of accounts. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        in: query
        name: accountNextPageToken
        required: false
        schema:
          type: string
      - description: Total number of accounts to return. An  **accountFetchCount** of 0 returns a nextPageToken but no accounts.
        in: query
        name: accountFetchCount
        required: false
        schema:
          format: int32
          type: integer
      - description: The page token to request next set of OUs. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        in: query
        name: ouNextPageToken
        required: false
        schema:
          type: string
      - description: Total number of OUs to return. An **ouFetchCount** of 0 returns a nextPageToken but no OUs.
        in: query
        name: ouFetchCount
        required: false
        schema:
          format: int32
          type: integer
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
        description: Cloud Account JSON
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AwsListChildrenApiResponseModel'
          description: success
        '400':
          description: permission_error / bad_request
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Children of Parent (AWS) - Legacy
      tags:
      - Cloud Accounts
  /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{account_id}/ancestors:
    post:
      description: For AWS only. Lists the ancestors of the given member accounts and organizational units (OUs) for the specified cloud account ID. A successful response returns an array of accounts and/or OUs each of which is mapped to an array of ancestor resource IDs.
      operationId: get-ancestors-for-given-members-ous-legacy
      parameters:
      - description: Account ID
        in: path
        name: account_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
        description: Cloud Account JSON
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/AwsNodeModel'
                type: array
          description: success
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Ancestors (AWS) - Legacy
      tags:
      - Cloud Accounts
  /cas/v1/aws_account:
    post:
      description: Onboard a new aws cloud account onto the Prisma Cloud platform.
      operationId: add-aws-cloud-account
      parameters:
      - description: true = Skip account status checks to improve response time
        in: query
        name: skipStatusChecks
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsCloudAccountRequestModel'
        description: Cloud Account
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: duplicate_cloud_account_name / duplicate_cloud_account / duplicate_cloud_account_needs_upgrade / cannot_select_zero_account_groups / invalid_account_group_ids / invalid_account_type
        '404':
          description: invalid_account_id_format
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call [Generate CFT api](/prisma-cloud/api/cspm/generate-cft-template-aws/)
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Add AWS Cloud Account
      tags:
      - Cloud Accounts
  /cas/v1/aws_account/{id}:
    put:
      description: Update information related to aws cloud account.
      operationId: update-aws-cloud-account
      parameters:
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          type: string
      - description: true = Skip account status checks to improve response time
        in: query
        name: skipStatusChecks
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsCloudAccountRequestModel'
        description: Cloud Account
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: duplicate_cloud_account_name / duplicate_cloud_account / cannot_select_zero_account_groups / invalid_account_group_ids / invalid_account_type
        '404':
          description: invalid_account_id_format
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call [Generate CFT api](/prisma-cloud/api/cspm/generate-cft-template-aws/)
        '500':
          description: not_found / internal_error
      security:
      - x-redlock-auth: []
      summary: Update AWS Cloud Account
      tags:
      - Cloud Accounts
  /cas/v1/cloud_account/status/aws:
    post:
      description: Lists status messages of the specified AWS cloud account.
      operationId: get-aws-cloud-account-status
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsCloudAccountRequestModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountStatus'
                type: array
          description: successful operation
        '400':
          description: bad_request
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call [Generate CFT api](/prisma-cloud/api/cspm/generate-cft-template-aws/)
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get AWS Cloud Account Status
      tags:
      - Cloud Accounts
  /cas/v1/aws_account/{parent_id}/children:
    post:
      description: For AWS only. Lists all the children of the given parent organizational unit (OU).The listed children include both OU resources and account resources.
      operationId: get-list-of-children-under-parent-aws
      parameters:
      - description: Parent OU ID
        in: path
        name: parent_id
        required: true
        schema:
          type: string
      - description: The page token to request the next page of accounts. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        in: query
        name: accountNextPageToken
        required: false
        schema:
          type: string
      - description: Total number of accounts to return. An  **accountFetchCount** of 0 returns a nextPageToken but no accounts.
        in: query
        name: accountFetchCount
        required: false
        schema:
          format: int32
          type: integer
      - description: The page token to request next set of OUs. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        in: query
        name: ouNextPageToken
        required: false
        schema:
          type: string
      - description: Total number of OUs to return. An **ouFetchCount** of 0 returns a nextPageToken but no OUs.
        in: query
        name: ouFetchCount
        required: false
        schema:
          format: int32
          type: integer
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsOrgChildrenRequestModel'
        description: Cloud Account JSON
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AwsListChildrenApiResponseModel'
          description: success
        '400':
          description: permission_error / bad_request
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call [Generate CFT api](/prisma-cloud/api/cspm/generate-cft-template-aws/)
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Children of Parent (AWS)
      tags:
      - Cloud Accounts
  /cas/v1/aws_account/{account_id}/ancestors:
    post:
      description: For AWS only. Lists the ancestors of the given member accounts and organizational units (OUs) for the specified cloud account ID. A successful response returns an array of accounts and/or OUs each of which is mapped to an array of ancestor resource IDs.
      operationId: get-ancestors-for-given-members-ous
      parameters:
      - description: Account ID
        in: path
        name: account_id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsOrgAncestorRequestModel'
        description: Cloud Account JSON
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/AwsNodeModel'
                type: array
          description: success
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call [Generate CFT api](/prisma-cloud/api/cspm/generate-cft-template-aws/)
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Ancestors (AWS)
      tags:
      - Cloud Accounts
components:
  schemas:
    DLPAPIResponse:
      description: Model for response from API
      properties:
        detail:
          description: Exception details
          type: string
        message:
          description: API response
          type: string
        name:
          description: Exception name
          type: string
      type: object
    AzureTenantModel:
      description: Model for Azure Tenant
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        name:
          description: Name
          type: string
        parentAccountId:
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          readOnly: true
          type: string
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
      type: object
    AWSOrgStatusConfigModel:
      description: Model for AWS Org Status Config
      properties:
        accountId:
          description: AWS account ID
          type: string
        externalId:
          description: AWS master external ID
          type: string
        roleArn:
          description: AWS master role ARN
          type: string
        snsTopicArn:
          description: SNS topic ARN for notification of storage object changes
          type: string
        tenantId:
          description: Tenant Id
          type: string
      required:
      - accountId
      - externalId
      - roleArn
      - snsTopicArn
      type: object
    AccountGroupInfo:
      description: Account group info linked to a cloud account
      properties:
        autoCreated:
          description: auto created
          readOnly: true
          type: boolean
        groupId:
          description: group id
          readOnly: true
          type: string
        groupName:
          description: Group name
          type: string
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
      type: object
    AWSOrgStatusResponseModel:
      description: Model for AWS Org Status Response
      properties:
        isSuccess:
          description: Boolean indicating if the operation was a success
          type: boolean
        message:
          description: List of error messages if the status check failed
          type: string
        sections:
          description: List indicating the location of failure
          items:
            type: string
          type: array
      type: object
    AWSOrgRequestConfigModel:
      description: Model for AWS Org Request Config
      properties:
        accountId:
          description: AWS account ID
          type: string
        cloudType:
          description: Cloud type
          enum:
          - AWS
          type: string
        masterExternalId:
          description: AWS master external ID, which establishes trust between your Prisma Cloud and AWS accounts
          type: string
        masterRoleArn:
          description: AWS master role ARN for your Prisma Cloud role
          type: string
        memberExternalId:
          description: AWS member external ID
          type: string
        memberRoleName:
          description: AWS memeber role name
          type: string
        scanOption:
          description: Scan option
          enum:
          - Full
          - Custom
          type: string
        snsTopicArn:
          description: SNS topic ARN for notification of storage object changes
          type: string
        storageUUID:
          description: Storage UUID
          type: string
      required:
      - accountId
      - cloudType
      - masterExternalId
      - masterRoleArn
      - memberExternalId
      - memberRoleName
      - scanOption
      - snsTopicArn
      - storageUUID
      type: object
    AccountStatusMessage:
      properties:
        message:
          type: string
        staticMessage:
          type: boolean
      type: object
    StorageScanConfigModel:
      description: Model for AWS Storage Scan Configuration
      properties:
        buckets:
          additionalProperties:
            items:
              type: string
            type: array
          description: Selected List of S3 Buckets for forward and backward scan
          type: object
        scanOption:
          description: Storage Scan Option
          enum:
          - Realtime
          - Custom
          - Full
          - Historical
          type: string
        snsTopicArn:
          description: SNS Topic ARN created on DLP SNS topic
          type: string
      type: object
    RelativeTimeRangeConfigModel:
      allOf:
      - $ref: '#/components/schemas/TimeRangeConfigModel'
      - description: Model for RelativeTimeRangeConfig
        properties:
          relativeTimeType:
            description: Direction in which to count time. Default = BACKWARD
            enum:
            - BACKWARD
            - FORWARD
            type: string
          type:
            example: relative
            type: string
          value:
            allOf:
            - $ref: '#/components/schemas/RelativeTimeDurationModel'
            - description: Time range object
        required:
        - value
        type: object
    GcpCloudProjectModel:
      description: Model for GCP Cloud Account
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        name:
          description: Name
          type: string
        parentAccountId:
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          readOnly: true
          type: string
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
      type: object
    AccountListRequestModel:
      description: Model for AccountListRequest
      properties:
        accountGroupIds:
          description: List of account group IDs
          items:
            type: string
          type: array
        accountIds:
          description: List of account IDs
          items:
            type: string
          type: array
        aggregate:
          description: true = aggregate
          type: boolean
        cloudType:
          type: string
        csvHeaderRequired:
          type: boolean
        filterKey:
          description: Filter key
          type: string
        filterValue:
          description: Filter value
          type: string
        groupBy:
          description: Group items by this value
          type: string
        limit:
          description: Limit of items per request. Default is 1000.
          format: int32
          type: integer
        timeRange:
          allOf:
          - $ref: '#/components/schemas/TimeRangeConfigModel'
          - description: Time range
      required:
      - timeRange
      type: object
    ToNowTimeRangeConfigModel:
      allOf:
      - $ref: '#/components/schemas/TimeRangeConfigModel'
      - description: Model for ToNowTimeRangeConfig
        properties:
          value:
            description: Time range object
            enum:
            - MINUTE
            - HOUR
            - DAY
            - WEEK
            - MONTH
            - YEAR
            - EPOCH
            - LOGIN
            type: string
        type: object
    OciCloudAccountModel:
      description: Model for OCI Cloud Account
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudAccountStatus:
          description: Internal use only
          readOnly: true
          type: object
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        defaultAccountGroupId:
          description: Default Account Group Id
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        groupName:
          description: Group Name
          type: string
        homeRegion:
          description: Home Region
          type: string
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        name:
          description: Name
          type: string
        parentAccountId:
          type: string
        policyName:
          description: Policy Name
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          type: string
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
        userName:
          description: User Name
          type: string
        userOcid:
          description: User OCID
          type: string
      type: object
    TimeRangeConfigModel:
      description: 'See the [Time Range Model](/prisma-cloud/api/cspm/api-time-range-model) for details.

        '
      discriminator:
        mapping:
          absolute: '#/components/schemas/AbsoluteTimeRangeConfigModel'
          relative: '#/components/schemas/RelativeTimeRangeConfigModel'
          to_now: '#/components/schemas/ToNowTimeRangeConfigModel'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/RelativeTimeRangeConfigModel'
      - $ref: '#/components/schemas/AbsoluteTimeRangeConfigModel'
      - $ref: '#/components/schemas/ToNowTimeRangeConfigModel'
      properties:
        type:
          description: Time type
          type: string
      required:
      - type
      type: object
    RelativeTimeDurationModel:
      description: Model for RelativeTimeDuration
      properties:
        amount:
          description: Number of time units
          format: int32
          type: integer
        unit:
          description: Time unit
          enum:
          - minute
          - hour
          - day
          - week
          - month
          - year
          type: string
      type: object
    AbsoluteTimeRangeConfigModel:
      allOf:
      - $ref: '#/components/schemas/TimeRangeConfigModel'
      - description: Model for AbsoluteTimeRangeConfig
        properties:
          type:
            example: absolute
            type: string
          value:
            allOf:
            - $ref: '#/components/schemas/TimeModel'
            - description: Time range object
        required:
        - value
        type: object
    CloudAccountConfigStatusView:
      description: Model for Cloud Account Config Status View
      properties:
        message:
          description: Message with details about service status
          type: string
        name:
          description: Prisma Cloud service
          type: string
        remediation:
          description: Suggestions for remediation
          type: string
        status:
          description: Service status
          type: string
        subComponents:
          items:
            $ref: '#/components/schemas/CloudAccountConfigStatusView'
          type: array
      type: object
    GcpResourceControllerRequestModel:
      description: Model containing the request for GCP Resources
      properties:
        cloudAccount:
          $ref: '#/components/schemas/CloudAccount'
        credentials:
          $ref: '#/components/schemas/Credentials'
      type: object
    CloudAccountIdentity:
      description: Model for Cloud Account Identity
      properties:
        cloudType:
          description: Cloud Type of Account/ Project/ Master Service Account/ Organization
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - IBM
          type: string
        id:
          description: ID of Account/ Project/ Master Service Account/ Organization
          type: string
        name:
          description: Name of Account/ Project/ Master Service Account/ Organization
          type: string
        parentAccountName:
          description: Parent Org Name of Account/ Project
          type: string
      type: object
    AzureSubscriptionModel:
      description: Model for Azure Cloud Account
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        name:
          description: Name
          type: string
        parentAccountId:
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          readOnly: true
          type: string
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
      type: object
    Credentials:
      description: The content of the credentials object is the Service Account Key for your Google Cloud service account
      properties:
        auth_provider_x509_cert_url:
          type: string
        auth_uri:
          type: string
        client_email:
          type: string
        client_id:
          type: string
        client_x509_cert_url:
          type: string
        private_key:
          type: string
        private_key_id:
          type: string
        project_id:
          type: string
        token_uri:
          type: string
        type:
          type: string
      type: object
    AzureHierarchyNodeModel:
      description: Model for AzureNode in the Tenant Hierarchy
      properties:
        displayName:
          description: Display name
          type: string
        hasChild:
          description: true = Has child
          type: boolean
        id:
          description: Node ID
          type: string
        parent:
          description: Parent
          type: string
        type:
          description: Node type
          enum:
          - TENANT
          - MANAGEMENT_GROUP
          - ACCOUNT
          type: string
      type: object
    CloudAccountStatus:
      properties:
        id:
          type: string
        name:
          type: string
        status:
          type: string
        statusMessage:
          $ref: '#/components/schemas/AccountStatusMessage'
      type: object
    AwsOrgTreeNode:
      description: Model for Aws Org Tree Node
      properties:
        displayName:
          description: Display name
          type: string
        hasChild:
          description: Has Child
          enum:
          - true
          - false
          type: boolean
        id:
          description: Node ID
          type: string
        parent:
          description: Parent
          type: string
        type:
          description: Node type
          enum:
          - ORG
          - FOLDER
          - PROJECT
          - SUBSCRIPTION
          - MANAGEMENT_GROUP
          - TENANT
          - ACCOUNT
          - OU
          type: string
      type: object
    AWSOrgConfig:
      description: Model for AWS Org Config
      properties:
        accountId:
          description: AWS account ID
          type: string
        masterCftLandingPage:
          description: AWS master CFT landing page
          type: string
        masterCftTemplate:
          description: AWS member CFT template
          type: string
        masterCftUrl:
          description: AWS master CFT URL
          type: string
        masterExternalId:
          description: AWS master external ID, which establishes trust between your Prisma Cloud and AWS accounts
          type: string
        masterRoleArn:
          description: AWS master role ARN for your Prisma Cloud role
          type: string
        memberCftTemplate:
          description: AWS member CFT template
          type: string
        memberCftUrl:
          description: AWS member CFT URL
          type: string
        memberExternalId:
          description: AWS member external ID
          type: string
        memberRoleName:
          description: AWS member role name
          type: string
        scanOption:
          description: Scan option
          enum:
          - Full
          - Custom
          type: string
        snsEndpointUrl:
          description: SNS subscription URL
          type: string
        snsTopicArn:
          description: SNS topic ARN for notification of storage object changes
          type: string
        storageUUID:
          description: Storage UUID
          type: string
      required:
      - masterCftLandingPage
      - masterCftTemplate
      - masterCftUrl
      - masterExternalId
      - masterRoleArn
      - memberCftTemplate
      - memberCftUrl
      - memberExternalId
      - memberRoleName
      - scanOption
      - snsEndpointUrl
      - snsTopicArn
      - storageUUID
      type: object
    AwsCloudOrgModel:
      description: Model for AWS Cloud Org
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        assumeRoleAccount:
          description: Internal use only
          readOnly: true
          type: string
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        defaultAccountGroupId:
          description: Default Account Group
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        eventbridgeRuleNamePrefix:
          description: Amazon Event Bridge Rule Name
          type: string
        externalId:
          description: External ID
          readOnly: true
          type: string
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        hierarchySelection:
          description: List of selected resources for hierarchy selection
          items:
            $ref: '#/components/schemas/HierarchySelection'
          type: array
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        memberExternalId:
          description: External Id in Member Accounts
          type: string
        memberRoleName:
          description: Role Name in Member Accounts
          type: string
        memberRoleStatus:
          description: Role Creation Status in Member Accounts
          type: boolean
        name:
          description: Name
          type: string
        parentAccountId:
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          readOnly: true
          type: string
        roleArn:
          description: Role ARN
          type: string
        storageScanConfig:
          allOf:
          - $ref: '#/components/schemas/StorageScanConfigModel'
          - description: Storage Scan Configurations
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
      type: object
    TerraformProvisionerRequest:
      description: Model for Generate Terraform Script API
      properties:
        accountId:
          description: OCID of the OCI tenancy
          type: string
        generateKeys:
          description: true = Generate keys. Default is false. Generated keys are valid for 24 hours.
          type: boolean
        groupName:
          description: OCI identity group name
          type: string
        policyName:
          description: OCI identity policy name
          type: string
        userName:
          description: OCI identity user name
          type: string
      required:
      - accountId
      - groupName
      - policyName
      - userName
      type: object
    HierarchySelection:
      description: Model for HierarchySelection
      properties:
        displayName:
          description: Display name
          example: Root
          type: string
        nodeType:
          description: Node type
          enum:
          - ORG
          - FOLDER
          - PROJECT
          - SUBSCRIPTION
          - MANAGEMENT_GROUP
          - TENANT
          - ACCOUNT
          - OU
          type: string
        resourceId:
          description: "Resource ID. \n\nNote you must escape any double quotes in the resource ID with a backslash"
          example: root
          type: string
        selectionType:
          description: Selection type
          enum:
          - ALL
          - INCLUDE
          - EXCLUDE
          type: string
      type: object
    AwsCloudAccountModel:
      description: Model for AWS Cloud Account
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        assumeRoleAccount:
          description: Internal use only
          readOnly: true
          type: string
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        eventbridgeRuleNamePrefix:
          description: Amazon Event Bridge Rule Name
          type: string
        externalId:
          description: External ID
          readOnly: true
          type: string
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        name:
          description: Name
          type: string
        parentAccountId:
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          readOnly: true
          type: string
        roleArn:
          description: Role ARN
          type: string
        storageScanConfig:
          allOf:
          - $ref: '#/components/schemas/StorageScanConfigModel'
          - description: Storage Scan Configurations
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
      type: object
    AwsOrgAncestorRequestModel:
      description: Model containing the request for AWS Org Ancestors
      properties:
        accountId:
          description: AWS Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - organization
          type: string
        enabled:
          description: Cloud Account Status. Whether or not the account is enabled
          type: boolean
        name:
          description: Name
          type: string
        resourceIds:
          description: Array of resource IDs (account IDs and/or OU IDs)
          items:
            type: string
          type: array
          uniqueItems: true
        roleArn:
          description: AWS Role ARN
          type: string
      required:
      - accountId
      - accountType
      - resourceIds
      - roleArn
      type: object
    CloudAccount:
      properties:
        accountId:
          description: GCP organization resource ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ORGANIZATION
          readOnly: true
          type: string
      type: object
    CloudAccountModel:
      anyOf:
      - $ref: '#/components/schemas/AwsCloudAccountModel'
      - $ref: '#/components/schemas/AwsCloudOrgModel'
      - $ref: '#/components/schemas/AzureSubscriptionModel'
      - $ref: '#/components/schemas/AzureTenantModel'
      - $ref: '#/components/schemas/GcpCloudProjectModel'
      - $ref: '#/components/schemas/GcpCloudOrgModel'
      - $ref: '#/components/schemas/AlibabaCloudAccountModel'
      - $ref: '#/components/schemas/OciCloudAccountModel'
      description: Model for Cloud Account Interface
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        name:
          description: Name
          type: string
        parentAccountId:
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          readOnly: true
          type: string
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
      type: object
    GcpNodeModel:
      description: Model for GcpNode
      properties:
        displayName:
          description: Display name
          type: string
        hasChild:
          description: true = Has child
          readOnly: true
          type: boolean
        id:
          description: Node ID
          type: string
        parent:
          description: Parent
          type: string
        type:
          description: Node type
          enum:
          - ORG
          - FOLDER
          - PROJECT
          - SUBSCRIPTION
          - MANAGEMENT_GROUP
          - TENANT
          - ACCOUNT
          - OU
          type: string
      type: object
    AwsListChildrenApiResponseModel:
      description: Model for AwsListChildrenApiResponse
      properties:
        accountNextPageToken:
          description: Next page token for account
          type: string
        ouNextPageToken:
          description: Next page token for Organizational Unit
          type: string
        response:
          description: List of node info
          items:
            $ref: '#/components/schemas/AwsOrgTreeNode'
          type: array
      type: object
    AwsCloudAccountRequestModel:
      description: Model containing the request for AWS Standalone and Org Cloud Account
      properties:
        accountId:
          description: AWS Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - organization
          - account
          type: string
        defaultAccountGroupId:
          description: "*Applicable only for accountType: **organization**.*\n\n This is the Default Account Group ID for the AWS organization and its member accounts."
          type: string
        enabled:
          description: Cloud Account Status. Whether or not the account is enabled
          type: boolean
        features:
          description: Features to be enabled and/ or disabled. To get a list of all the supported features, call [Features API](/prisma-cloud/api/cspm/fetch-supported-features/)
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Account Group Ids for this account
          items:
            type: string
          type: array
        hierarchySelection:
          description: "*Applicable only for accountType: **organization**.*\n\n Include/Exclude a list of AWS Organization Units (OU), AWS accounts, and AWS Organizations to onboard under this organization."
          items:
            $ref: '#/components/schemas/HierarchySelection'
          type: array
        name:
          description: Name to be used for the account on the Prisma Cloud platform (must be unique)
          type: string
        roleArn:
          description: AWS Role ARN
          type: string
      required:
      - accountId
      - accountType
      - name
      - roleArn
      type: object
    AzureAncestorsModel:
      description: Model for Azure GetAncestors API Response
      properties:
        ancestors:
          description: List of ancestors
          items:
            $ref: '#/components/schemas/AzureHierarchyNodeModel'
          type: array
        resourceId:
          description: Resource ID
          type: string
      type: object
    GcpCloudOrgModel:
      description: Model for GCP Cloud Account
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        name:
          description: Name
          type: string
        parentAccountId:
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          readOnly: true
          type: string
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
      type: object
    AwsOrgChildrenRequestModel:
      description: Model containing the request for AWS Org Children
      properties:
        accountId:
          description: AWS Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - organization
          type: string
        enabled:
          description: Cloud Account Status. Whether or not the account is enabled
          type: boolean
        name:
          description: Name
          type: string
        roleArn:
          description: AWS Role ARN
          type: string
      required:
      - accountId
      - accountType
      - roleArn
      type: object
    CloudAccountViewModel:
      description: Model for Cloud Account View
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        groups:
          description: Groups
          items:
            additionalProperties:
              type: object
            type: object
          readOnly: true
          type: array
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        name:
          description: Name
          type: string
        numberOfChildAccounts:
          format: int32
          type: integer
        parentAccountId:
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          readOnly: true
          type: string
        status:
          description: Account Config Status
          type: string
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
      type: object
    AlibabaCloudAccountModel:
      description: Model for Alibaba Cloud Account
      properties:
        accountGroupInfos:
          description: Account group details of groups associated with this account
          items:
            $ref: '#/components/schemas/AccountGroupInfo'
          type: array
        accountId:
          description: Account ID
          type: string
        accountType:
          description: Cloud Account Type
          enum:
          - ACCOUNT
          - MASTER_SERVICE_ACCOUNT
          - COMPARTMENT
          - ORGANIZATION
          - TENANT
          readOnly: true
          type: string
        addedOn:
          description: Added On
          format: int64
          readOnly: true
          type: integer
        associatedAccountGroupsCount:
          description: Associated Account Groups Count with this cloud account
          format: int32
          type: integer
        cloudAccountOwner:
          description: Cloud account owner
          type: string
        cloudAccountOwnerCount:
          description: Cloud account owner count
          format: int32
          readOnly: true
          type: integer
        cloudAccountStatus:
          description: Internal use only
          readOnly: true
          type: object
        cloudType:
          description: Cloud Type
          enum:
          - ALL
          - AWS
          - AZURE
          - GCP
          - ALIBABA_CLOUD
          - OCI
          - OTHER
          readOnly: true
          type: string
        deploymentType:
          description: Deployment Type
          enum:
          - AZURE
          - AZURE_GOVERNMENT
          - AZURE_CHINA
          - AWS
          - AWS_GOVERNMENT
          - AWS_CHINA
          - OCI
          - OCI_GOVERNMENT
          - OCI_CHINA
          - GCP
          - GCP_GOVERNMENT
          - GCP_CHINA
          - ALIBABA_CLOUD
          - ALIBABA_CLOUD_GOVERNMENT
          - ALIBABA_CLOUD_CHINA
          - ALIBABA_CLOUD_FINANCE
          type: string
        enabled:
          description: Enabled
          type: boolean
        features:
          description: Features
          items:
            $ref: '#/components/schemas/Feature'
          type: array
          uniqueItems: true
        groupIds:
          description: Group Ids
          items:
            type: string
          readOnly: true
          type: array
        lastModifiedBy:
          description: Last Modified By
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time account was last updated
          format: int64
          readOnly: true
          type: integer
        name:
          description: Name
          type: string
        parentAccountId:
          type: string
        protectionMode:
          description: Protection Mode
          enum:
          - MONITOR
          - MONITOR_AND_PROTECT
          readOnly: true
          type: string
        ramArn:
          description: Ram ARN
          type: string
        storageScanEnabled:
          description: Storage Scan Enabled
          type: boolean
        storageUUID:
          description: Storage UUID
          type: string
      type: object
    Feature:
      description: Model for Feature
      properties:
        name:
          description: name
          example: Remediation
          type: string
        state:
          description: state
          enum:
          - enabled
          - disabled
          type: string
      type: object
    AwsNodeModel:
      description: Model for AncestorApiResponse
      properties:
        ancestors:
          description: List of ancestors
          items:
            $ref: '#/components/schemas/AwsOrgTreeNode'
          type: array
        resourceId:
          description: Resource ID
          type: string
        responseCode:
          description: Response code
          format: int32
          type: integer
        status:
          description: Status
          type: string
      type: object
    ListChildrenApiResponseModel:
      description: Model for ListChildrenApiResponse
      properties:
        folderNextPageToken:
          description: Next page token for folder
          type: string
        projectNextPageToken:
          description: Next page token for project
          type: string
        response:
          description: List of node info
          items:
            $ref: '#/components/schemas/GcpNodeModel'
          type: array
      type: object
    TimeModel:
      description: Model for Time
      properties:
        endTime:
          description: End timestamp
          format: int64
          type: integer
        startTime:
          description: Start timestamp
          format: int64
          type: integer
      type: object
    Resources:
      description: Resources Model for Identifying Ancestors
      properties:
        resourceIds:
          description: Array of resource IDs (Subscription and/or Management Group IDs)
          items:
            type: string
          type: array
          uniqueItems: true
      type: object
    CloudAccountPatchModel:
      description: Model for Account Group View
      properties:
        enabled:
          description: Cloud Account Status
          enum:
          - false
          type: boolean
        groupIds:
          description: Associated Account Group Ids
          items:
            type: string
          type: array
        updateChildrenStatus:
          description: Update Children status
          enum:
          - false
          type: boolean
      type: object
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey