openapi: 3.2.0
info:
  title: Palo Alto Networks Cloud Accounts (AWS) API
  version: '1.0'
  description: 'Operations tagged Cloud Accounts (AWS) across 4 of this provider''s published API definitions: palo-alto-cspm-cloudaccountonboardingmicroservices-openapi.json, palo-alto-cspm-cloudaccounts-aws-openapi.json, palo-alto-cspm-cloudaccountsmicroservice-openapi.json, palo-alto-cspm-datasecurityonboardingmicroservice-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- name: Cloud Accounts (AWS)
  description: "To monitor the resources on your AWS cloud infrastructure, you must first add your AWS accounts to Prisma Cloud. When you add your cloud account to Prisma Cloud, the API integration between AWS and Prisma Cloud is established and you can begin monitoring the resources and identify potential security risks.\n\nThe Cloud Account (AWS) APIs enable you to add and manage AWS accounts on Prisma Cloud. For end to end workflow to onboarding an AWS account using APIs, see [Automate AWS Cloud Account Onboarding](/prisma-cloud/docs/cspm/aws-cloud-account-onboarding/).\n For common operations related to cloud accounts, see [Cloud Accounts (All)](/prisma-cloud/api/cspm/cloud-accounts-all/).\n"
paths:
  /cas/v1/aws_account:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: Add Cloud Account (AWS)
      description: "Onboard a new aws cloud account onto the Prisma Cloud platform.\n\n **Prerequisite**: Generate the externalId and AWS CFT template by calling either **[Generate and Download the CFT Template Endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**"
      operationId: add-aws-cloud-account
      parameters:
      - name: skipStatusChecks
        in: query
        description: true = Skip account status checks to improve response time
        required: false
        schema:
          type: boolean
      requestBody:
        $ref: '#/components/requestBodies/AwsCloudAccountRequestModel2'
      responses:
        '200':
          description: successful operation
        '400':
          description: duplicate_cloud_account_name / duplicate_cloud_account / duplicate_cloud_account_needs_upgrade / cannot_select_zero_account_groups / invalid_account_group_ids / invalid_account_type
        '404':
          description: invalid_account_id_format
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_account/{account_id}/ancestors:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: List Ancestors (AWS)
      description: Lists the ancestors of the given member accounts and organizational units (OUs) for the specified cloud account ID. A successful response returns an array of accounts and/or OUs each of which is mapped to an array of ancestor resource IDs.
      operationId: get-ancestors-for-given-members-ous
      parameters:
      - name: account_id
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsOrgAncestorRequestModel'
        description: Cloud Account JSON
        required: true
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AwsNodeModel'
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_account/{id}:
    put:
      tags:
      - Cloud Accounts (AWS)
      summary: Update Cloud Account (AWS)
      description: Update details of an AWS cloud account that is already present in Prisma Cloud. **Note:** To enable or disable a cloud account, use [Update Cloud Account Status](https://pan.dev/prisma-cloud/api/cspm/update-cloud-account-status/) API.
      operationId: update-aws-cloud-account
      parameters:
      - name: id
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      - name: skipStatusChecks
        in: query
        description: true = Skip account status checks to improve response time
        required: false
        schema:
          type: boolean
      requestBody:
        $ref: '#/components/requestBodies/AwsCloudAccountRequestModel2'
      responses:
        '200':
          description: successful operation
        '400':
          description: duplicate_cloud_account_name / duplicate_cloud_account / cannot_select_zero_account_groups / invalid_account_group_ids / invalid_account_type
        '404':
          description: invalid_account_id_format
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_account/{parent_id}/children:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: List Children of Parent (AWS)
      description: For AWS only. Lists all the children of the given parent organizational unit (OU).The listed children include both OU resources and account resources.
      operationId: get-list-of-children-under-parent-aws
      parameters:
      - name: parent_id
        in: path
        description: Parent OU ID
        required: true
        schema:
          type: string
      - name: accountNextPageToken
        in: query
        description: The page token to request the next page of accounts. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        required: false
        schema:
          type: string
      - name: accountFetchCount
        in: query
        description: Total number of accounts to return. An  **accountFetchCount** of 0 returns a nextPageToken but no accounts.
        required: false
        schema:
          type: integer
          format: int32
      - name: ouNextPageToken
        in: query
        description: The page token to request next set of OUs. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        required: false
        schema:
          type: string
      - name: ouFetchCount
        in: query
        description: Total number of OUs to return. An **ouFetchCount** of 0 returns a nextPageToken but no OUs.
        required: false
        schema:
          type: integer
          format: int32
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsOrgChildrenRequestModel'
        description: Cloud Account JSON
        required: true
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AwsListChildrenApiResponseModel'
        '400':
          description: permission_error / bad_request
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/cloud_account/status/aws:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: Get Cloud Account Status (AWS)
      description: Lists status messages of the specified AWS cloud account.
      operationId: get-aws-cloud-account-status
      parameters:
      - name: automatedFlow
        in: query
        required: false
        schema:
          type: boolean
      requestBody:
        $ref: '#/components/requestBodies/AwsCloudAccountRequestModel'
      responses:
        '200':
          description: successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CloudAccountStatus'
        '400':
          description: bad_request
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{account_id}/ancestors:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: List Ancestors (AWS) - Legacy
      description: For AWS only. Lists the ancestors of the given member accounts and organizational units (OUs) for the specified cloud account ID. A successful response returns an array of accounts and/or OUs each of which is mapped to an array of ancestor resource IDs.
      operationId: get-ancestors-for-given-members-ous-legacy
      parameters:
      - name: account_id
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      requestBody:
        $ref: '#/components/requestBodies/get-ancestors-for-given-members-ous-legacyBody'
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AwsNodeModel'
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{parent_id}/children:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: List Children of Parent (AWS) - Legacy
      description: Lists all the children of the given parent organizational unit (OU).The listed children include both OU resources and account resources.
      operationId: get-list-of-children-under-parent-aws-legacy
      parameters:
      - name: parent_id
        in: path
        description: Parent OU ID
        required: true
        schema:
          type: string
      - name: accountNextPageToken
        in: query
        description: The page token to request the next page of accounts. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        required: false
        schema:
          type: string
      - name: accountFetchCount
        in: query
        description: Total number of accounts to return. An  **accountFetchCount** of 0 returns a nextPageToken but no accounts.
        required: false
        schema:
          type: integer
          format: int32
      - name: ouNextPageToken
        in: query
        description: The page token to request next set of OUs. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        required: false
        schema:
          type: string
      - name: ouFetchCount
        in: query
        description: Total number of OUs to return. An **ouFetchCount** of 0 returns a nextPageToken but no OUs.
        required: false
        schema:
          type: integer
          format: int32
      requestBody:
        $ref: '#/components/requestBodies/get-ancestors-for-given-members-ous-legacyBody'
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AwsListChildrenApiResponseModel'
        '400':
          description: permission_error / bad_request
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /dlp/api/v1/config/awsorg/status:
    post:
      deprecated: true
      description: Returns whether or not the set up for your AWS Organization meets the prerequisites for successful creation of a data security configuration.
      operationId: get-status-for-org
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/AWSOrgStatusConfigModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AWSOrgStatusResponseModel'
          description: success
        '400':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/DLPAPIResponse'
          description: bad_request
      security:
      - x-redlock-auth: []
      summary: Check Data Security Preconditions (AWS Org)
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /dlp/api/config/v2:
    post:
      deprecated: true
      description: Creates a data security configuration for an AWS Organization.
      operationId: onboard-aws-org-scan
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/AWSOrgRequestConfigModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/DLPAPIResponse'
          description: success
      security:
      - x-redlock-auth: []
      summary: Add Data Security Config (AWS Org)
      tags:
      - Cloud Accounts (AWS)
    put:
      deprecated: true
      description: Updates the data security configuration for the AWS Organization with the specified account ID.
      operationId: update-aws-org-scan-config
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/AWSOrgRequestConfigModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/DLPAPIResponse'
          description: success
      security:
      - x-redlock-auth: []
      summary: Update Data Security Config (AWS Org)
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /dlp/api/config/v2/{accountId}:
    get:
      deprecated: true
      description: Returns the data security configuration for the AWS Organization with the specified account ID.
      operationId: get-aws-org-scan-details
      parameters:
      - description: AWS account ID
        in: path
        name: accountId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AWSOrgConfig'
          description: success
      security:
      - x-redlock-auth: []
      summary: Get Data Security Config (AWS Org)
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_template/presigned_url:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: Generate the CFT Template Link (AWS)
      description: "Generates the AWS Cloudformation Stack Quick create link with S3 presigned CFT URL. The Generated CFT template will include Prisma Cloud generated externalId and the permissions based on selected features.\n\n The response contains *createStackLinkWithS3PresignedUrl* key whose value can be used to create IAM role via AWS CloudFormation stack.\n\n There are 2 ways to create IAM role:\n\n 1. [Manual] If you are logged into your AWS Management console, directly open the value of the *createStackLinkWithS3PresignedUrl* key on a new tab in the browser.\n 2. [Automation] Else, you can extract the actual S3 Presigned CFT URL from the *createStackLinkWithS3PresignedUrl* key by splitting at templateURL= and url decoding the last index of the split(i.e right part of the split). This extracted decoded link can be used to create or update the IAM role CloudFormation stack. \n\n  **NOTE**: The *createStackLinkWithS3PresignedUrl* link is valid for 1hr"
      operationId: generate-cft-template-link-aws
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AWSTemplateGenRequest'
        required: true
      responses:
        '200':
          description: Template Generated Successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCFTGenResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '401':
          description: Unauthorized Access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '403':
          description: Tenant License Expired
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '405':
          description: Wrong Http Method
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '425':
          description: Too Early to access the resource
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '429':
          description: Rate Limit Exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      x-public: 'true'
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_template:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: Generate and Download the CFT Template (AWS)
      description: "Generates the AWS CFT template. The Generated CFT template includes Prisma Cloud generated externalId and the permissions based on selected features.\n The CFT template can be used to create IAM role via AWS CloudFormation stack."
      operationId: generate-cft-template-aws
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AWSTemplateGenRequest'
        required: true
      responses:
        '200':
          description: Template Generated Successfully
        '400':
          description: Bad Request/Bad Request with accountType account, only valid cftType is account/Bad Request with accountType organization, cftType account is not valid/AccountType can be one of the following [account , organization]/AccountId is not valid Feature list is invalid /Invalid usage of customMemberRoleNameEnabled
        '401':
          description: Unauthorized Access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '403':
          description: Tenant License Expired
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '405':
          description: Wrong Http Method
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '425':
          description: Too Early to access the resource
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '429':
          description: Rate Limit Exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      x-public: 'true'
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /config/v3/account/awsorg/{id}:
    get:
      summary: Fetch Master Account Details (AWS Org)
      description: Returns the necessary attributes that define the AWS ORG account necessary for various PCDS flows.
      operationId: getAwsOrgCloudConfig
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: success
          content:
            application/json: {}
        '400':
          description: bad_request
      x-public: 'true'
      security:
      - x-redlock-auth: []
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /config/v3/account/awsorg/{id}/status:
    get:
      summary: Performs a Permissions Check for the Given PCDS Account (AWS Org)
      description: Returns details pertaining to the rudimentary permissions check - contains details pertaining to any missing permissions.
      operationId: get-status-pcds-aws-org-account
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: success
          content:
            application/json: {}
      x-public: 'true'
      security:
      - x-redlock-auth: []
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
components:
  schemas:
    CloudAccountStatus:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        status:
          type: string
        statusMessage:
          $ref: '#/components/schemas/AccountStatusMessage'
    AwsListChildrenApiResponseModel:
      type: object
      properties:
        response:
          type: array
          description: List of node info
          items:
            $ref: '#/components/schemas/AwsOrgTreeNode'
        accountNextPageToken:
          type: string
          description: Next page token for account
        ouNextPageToken:
          type: string
          description: Next page token for Organizational Unit
      description: Model for AwsListChildrenApiResponse
    AwsCloudAccountRequestModel:
      type: object
      required:
      - accountId
      - accountType
      - name
      - roleArn
      properties:
        accountId:
          type: string
          description: AWS Account ID
        enabled:
          type: boolean
          description: True to enable ingestion of logs to Prisma Cloud. The default value is True. \n **NOTE:** Ingestion will be stopped if enabled is set to False
        name:
          type: string
          description: Name to be used for the account on the Prisma Cloud platform (must be unique)
        roleArn:
          type: string
          description: AWS Role ARN
        accountType:
          type: string
          description: Cloud Account Type
          enum:
          - organization
          - account
        features:
          type: array
          description: Features to be enabled and/ or disabled. To get a list of all the supported features, call **[Fetch Supported Features endpoint](/prisma-cloud/api/cspm/fetch-supported-features)**
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Feature'
        groupIds:
          type: array
          description: Account Group Ids for this account
          items:
            type: string
        defaultAccountGroupId:
          type: string
          description: "*Applicable only for accountType: **organization**.*\n\n This is the Default Account Group ID for the AWS organization and its member accounts."
        hierarchySelection:
          type: array
          description: "*Applicable only for accountType: **organization**.*\n\n Include/Exclude a list of AWS Organization Units (OU), AWS accounts, and AWS Organizations to onboard under this organization."
          items:
            $ref: '#/components/schemas/AwsHierarchySelectionModel'
        customMemberRoleNameEnabled:
          type: boolean
          description: "Applicable only for the **organization accountType**.\n\n The default value is false. If it is set to true, you must provide a **memberRole** name."
        skipOverrideMemberRoleName:
          type: boolean
          description: "Applicable only for the **organization accountType**.\n\n The default value is true. If it is set to false, the existing Role Name and external ID for the member accounts will be retained."
        unifiedCftDisabled:
          type: boolean
          description: "Applicable only for the organization accountType.\n\n The default value is false. If it is set true, you will get different CFT's for Management and Member accounts."
        memberRoleName:
          type: boolean
          description: Applicable only for the **organization accountType** and when **customMemberRoleNameEnabled** is set to true.
        useTenantExternalId:
          type: boolean
          description: Specify whether to use tenantExternalId,  the default is `false`
      description: Model containing the request for AWS Standalone and Org Cloud Account
    AwsOrgTreeNode:
      type: object
      properties:
        id:
          type: string
          description: Node ID
        type:
          type: string
          description: Node type
          enum:
          - ORG
          - FOLDER
          - PROJECT
          - SUBSCRIPTION
          - MANAGEMENT_GROUP
          - TENANT
          - ACCOUNT
          - OU
        displayName:
          type: string
          description: Display name
        parent:
          type: string
          description: Parent
        hasChild:
          type: boolean
          description: Has Child
          enum:
          - true
          - false
      description: Model for Aws Org Tree Node
    AwsHierarchySelectionModel:
      type: object
      properties:
        resourceId:
          type: string
          example: root
          description: 'To get the list of resource IDs and its details, Refer [List Children of Parent (AWS)](/prisma-cloud/api/cspm/get-list-of-children-under-parent-aws/) '
        displayName:
          type: string
          example: Root
          description: To get the display name of resource, Refer [List Children of Parent (AWS)](/prisma-cloud/api/cspm/get-list-of-children-under-parent-aws/)
        nodeType:
          type: string
          description: Member account node type. Supported values are ORG, OU or ACCOUNT
        selectionType:
          type: string
          description: "Organization Member accounts Selection type. \n\n**ALL**: Include the resource and all its children \n\n**INCLUDE**: Include the specified resource\n\n**EXCLUDE**: Exclude the specified resource"
          enum:
          - ALL
          - INCLUDE
          - EXCLUDE
      description: Model for HierarchySelection for Aws
    AwsOrgChildrenRequestModel:
      type: object
      required:
      - accountId
      - accountType
      - roleArn
      properties:
        accountId:
          type: string
          description: AWS Account ID
        enabled:
          type: boolean
          description: True to enable ingestion of logs to Prisma Cloud. The default value is True. \n **NOTE:** Ingestion will be stopped if enabled is set to False
        name:
          type: string
          description: Name
        roleArn:
          type: string
          description: AWS Role ARN
        accountType:
          type: string
          description: Cloud Account Type
          enum:
          - organization
        useTenantExternalId:
          type: boolean
          description: Specify whether to use tenantExternalId,  the default is `false`
      description: Model containing the request for AWS Org Children
    AccountStatusMessage:
      type: object
      properties:
        message:
          type: string
        staticMessage:
          type: boolean
    Feature:
      type: object
      properties:
        name:
          type: string
          example: Remediation
          description: Feature name obtained from **[Fetch Supported Features endpoint](/prisma-cloud/api/cspm/fetch-supported-features)**
        state:
          type: string
          description: Feature state. Whether to be enabled or disabled
          enum:
          - enabled
          - disabled
        defaultMemberState:
          type: string
          description: Enable or disable the feature for all the member accounts linked to this organization. You can enable or disable the defaultMemberState only if the feature state is enabled for the organization. Applicable only for Serverless Function Scanning and Agentless Workload Scanning features.
          enum:
          - enabled
          - disabled
      description: Model for Feature
    AwsNodeModel:
      type: object
      properties:
        resourceId:
          type: string
          description: Resource ID
        ancestors:
          type: array
          description: List of ancestors
          items:
            $ref: '#/components/schemas/AwsOrgTreeNode'
        status:
          type: string
          description: Status
        responseCode:
          type: integer
          format: int32
          description: Response code
      description: Model for AncestorApiResponse
    AwsOrgAncestorRequestModel:
      type: object
      required:
      - accountId
      - accountType
      - resourceIds
      - roleArn
      properties:
        accountId:
          type: string
          description: AWS Account ID
        enabled:
          type: boolean
          description: True to enable ingestion of logs to Prisma Cloud. The default value is True. \n **NOTE:** Ingestion will be stopped if enabled is set to False
        name:
          type: string
          description: Name
        roleArn:
          type: string
          description: AWS Role ARN
        accountType:
          type: string
          description: Cloud Account Type
          enum:
          - organization
        resourceIds:
          type: array
          description: Array of resource IDs (account IDs and/or OU IDs)
          uniqueItems: true
          items:
            type: string
      description: Model containing the request for AWS Org Ancestors
    DLPAPIResponse:
      description: Model for response from API
      properties:
        detail:
          description: Exception details
          type: string
        message:
          description: API response
          type: string
        name:
          description: Exception name
          type: string
      type: object
    AWSOrgStatusConfigModel:
      description: Model for AWS Org Status Config
      properties:
        accountId:
          description: AWS account ID
          type: string
        externalId:
          description: AWS master external ID
          type: string
        roleArn:
          description: AWS master role ARN
          type: string
        snsTopicArn:
          description: SNS topic ARN for notification of storage object changes
          type: string
        tenantId:
          description: Tenant Id
          type: string
      required:
      - accountId
      - externalId
      - roleArn
      - snsTopicArn
      type: object
    AWSOrgConfig:
      description: Model for AWS Org Config
      properties:
        accountId:
          description: AWS account ID
          type: string
        masterCftLandingPage:
          description: AWS master CFT landing page
          type: string
        masterCftTemplate:
          description: AWS member CFT template
          type: string
        masterCftUrl:
          description: AWS master CFT URL
          type: string
        masterExternalId:
          description: AWS master external ID, which establishes trust between your Prisma Cloud and AWS accounts
          type: string
        masterRoleArn:
          description: AWS master role ARN for your Prisma Cloud role
          type: string
        memberCftTemplate:
          description: AWS member CFT template
          type: string
        memberCftUrl:
          description: AWS member CFT URL
          type: string
        memberExternalId:
          description: AWS member external ID
          type: string
        memberRoleName:
          description: AWS member role name
          type: string
        scanOption:
          description: Scan option
          enum:
          - Full
          - Custom
          type: string
        snsEndpointUrl:
          description: SNS subscription URL
          type: string
        snsTopicArn:
          description: SNS topic ARN for notification of storage object changes
          type: string
        storageUUID:
          description: Storage UUID
          type: string
      required:
      - masterCftLandingPage
      - masterCftTemplate
      - masterCftUrl
      - masterExternalId
      - masterRoleArn
      - memberCftTemplate
      - memberCftUrl
      - memberExternalId
      - memberRoleName
      - scanOption
      - snsEndpointUrl
      - snsTopicArn
      - storageUUID
      type: object
    AWSOrgStatusResponseModel:
      description: Model for AWS Org Status Response
      properties:
        isSuccess:
          description: Boolean indicating if the operation was a success
          type: boolean
        message:
          description: List of error messages if the status check failed
          type: string
        sections:
          description: List indicating the location of failure
          items:
            type: string
          type: array
      type: object
    AWSOrgRequestConfigModel:
      description: Model for AWS Org Request Config
      properties:
        accountId:
          description: AWS account ID
          type: string
        cloudType:
          description: Cloud type
          enum:
          - AWS
          type: string
        masterExternalId:
          description: AWS master external ID, which establishes trust between your Prisma Cloud and AWS accounts
          type: string
        masterRoleArn:
          description: AWS master role ARN for your Prisma Cloud role
          type: string
        memberExternalId:
          description: AWS member external ID
          type: string
        memberRoleName:
          description: AWS memeber role name
          type: string
        scanOption:
          description: Scan option
          enum:
          - Full
          - Custom
          type: string
        snsTopicArn:
          description: SNS topic ARN for notification of storage object changes
          type: string
        storageUUID:
          description: Storage UUID
          type: string
      required:
      - accountId
      - cloudType
      - masterExternalId
      - masterRoleArn
      - memberExternalId
      - memberRoleName
      - scanOption
      - snsTopicArn
      - storageUUID
      type: object
    AWSTemplateGenRequest:
      required:
      - accountId
      - accountType
      type: object
      properties:
        accountType:
          type: string
          description: Cloud Account Type
          example: null
          enum:
          - account
          - organization
        accountId:
          type: string
          description: Account Id
          example: null
        awsPartition:
          type: string
          description: "*Applicable only for Prisma Government Stack(**app.gov.prismacloud.io**) and given if the Cloud account Global Deployment option is enabled*\n\n * **us-east-1** -  AWS Commercial/Global account\n\n * **us-gov-west-1** - AWS GovCloud account."
          example: null
          enum:
          - us-east-1
          - us-gov-west-1
        features:
          uniqueItems: true
          type: array
          description: "Features for which the permissions should be generated and included in the template. \n\n To get a list of all the supported features, call **[Get Supported Features](/prisma-cloud/api/cspm/fetch-supported-features)** endpoint"
          example:
          - Remediation
          items:
            type: string
            description: "Features for which the permissions should be generated and included in the template. \n\n To get a list of all the supported features, call **[Get Supported Features](/prisma-cloud/api/cspm/fetch-supported-features)** endpoint"
            example: '["Remediation"]'
        customMemberRoleNameEnabled:
          type: boolean
          description: Applicable only when accountType is organization the default is `false`. However, if set to true, you will be prompted to provide member role when using the terraform CFT template.
          example: null
        cftType:
          type: string
          description: The type of cft that you want to download.
          example: null
          enum:
          - org_member
          - org_management
          - org_management_member
          - account
        useTenantExternalId:
          type: boolean
          description: Set it to true to use tenantExternalId. The default is `false`.
          example: null
      example: null
    AWSCFTGenResponse:
      type: object
      properties:
        createStackLinkWithS3PresignedUrl:
          type: string
          description: AWS Cloudformation Stack Quick Create link.
          example: null
        externalId:
          type: string
          example: null
      example: null
    ApiError:
      type: object
      properties:
        status:
          type: string
          example: null
          enum:
          - 100 CONTINUE
          - 101 SWITCHING_PROTOCOLS
          - 102 PROCESSING
          - 103 CHECKPOINT
          - 200 OK
          - 201 CREATED
          - 202 ACCEPTED
          - 203 NON_AUTHORITATIVE_INFORMATION
          - 204 NO_CONTENT
          - 205 RESET_CONTENT
          - 206 PARTIAL_CONTENT
          - 207 MULTI_STATUS
          - 208 ALREADY_REPORTED
          - 226 IM_USED
          - 300 MULTIPLE_CHOICES
          - 301 MOVED_PERMANENTLY
          - 302 FOUND
          - 302 MOVED_TEMPORARILY
          - 303 SEE_OTHER
          - 304 NOT_MODIFIED
          - 305 USE_PROXY
          - 307 TEMPORARY_REDIRECT
          - 308 PERMANENT_REDIRECT
          - 400 BAD_REQUEST
          - 401 UNAUTHORIZED
          - 402 PAYMENT_REQUIRED
          - 403 FORBIDDEN
          - 404 NOT_FOUND
          - 405 METHOD_NOT_ALLOWED
          - 406 NOT_ACCEPTABLE
          - 407 PROXY_AUTHENTICATION_REQUIRED
          - 408 REQUEST_TIMEOUT
          - 409 CONFLICT
          - 410 GONE
          - 411 LENGTH_REQUIRED
          - 412 PRECONDITION_FAILED
          - 413 PAYLOAD_TOO_LARGE
          - 413 REQUEST_ENTITY_TOO_LARGE
          - 414 URI_TOO_LONG
          - 414 REQUEST_URI_TOO_LONG
          - 415 UNSUPPORTED_MEDIA_TYPE
          - 416 REQUESTED_RANGE_NOT_SATISFIABLE
          - 417 EXPECTATION_FAILED
          - 418 I_AM_A_TEAPOT
          - 419 INSUFFICIENT_SPACE_ON_RESOURCE
          - 420 METHOD_FAILURE
          - 421 DESTINATION_LOCKED
          - 422 UNPROCESSABLE_ENTITY
          - 423 LOCKED
          - 424 FAILED_DEPENDENCY
          - 425 TOO_EARLY
          - 426 UPGRADE_REQUIRED
          - 428 PRECONDITION_REQUIRED
          - 429 TOO_MANY_REQUESTS
          - 431 REQUEST_HEADER_FIELDS_TOO_LARGE
          - 451 UNAVAILABLE_FOR_LEGAL_REASONS
          - 500 INTERNAL_SERVER_ERROR
          - 501 NOT_IMPLEMENTED
          - 502 BAD_GATEWAY
          - 503 SERVICE_UNAVAILABLE
          - 504 GATEWAY_TIMEOUT
          - 505 HTTP_VERSION_NOT_SUPPORTED
          - 506 VARIANT_ALSO_NEGOTIATES
          - 507 INSUFFICIENT_STORAGE
          - 508 LOOP_DETECTED
          - 509 BANDWIDTH_LIMIT_EXCEEDED
          - 510 NOT_EXTENDED
          - 511 NETWORK_AUTHENTICATION_REQUIRED
        timestamp:
          type: string
          format: date-time
          example: null
        message:
          type: string
          example: null
        debugMessage:
          type: string
          example: null
      example: null
  requestBodies:
    AwsCloudAccountRequestModel2:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AwsCloudAccountRequestModel'
      description: Cloud Account
      required: true
    AwsCloudAccountRequestModel:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AwsCloudAccountRequestModel'
    get-ancestors-for-given-members-ous-legacyBody:
      content:
        application/json:
          schema:
            type: object
            additionalProperties:
              type: object
      description: Cloud Account JSON
      required: true
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
x-refined-from:
- palo-alto-cspm-cloudaccountonboardingmicroservices-openapi.json
- palo-alto-cspm-cloudaccounts-aws-openapi.json
- palo-alto-cspm-cloudaccountsmicroservice-openapi.json
- palo-alto-cspm-datasecurityonboardingmicroservice-openapi.json