openapi: 3.2.0
info:
  title: Palo Alto Networks Cloud Accounts (Azure) API
  version: '1.0'
  description: 'Operations tagged Cloud Accounts (Azure) across 2 of this provider''s published API definitions: palo-alto-cspm-cloudaccountonboardingmicroservices-openapi.json, palo-alto-cspm-cloudaccountsmicroservice-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- name: Cloud Accounts (Azure)
  description: "To monitor the resources on your Azure cloud infrastructure, you must first add your Azure accounts to Prisma Cloud. When you add your cloud account to Prisma Cloud, the API integration between Azure and Prisma Cloud is established and you can begin monitoring the resources and identify potential security risks.\n\nThe Cloud Account (Azure) APIs enable you to add and manage Azure accounts on Prisma Cloud. For end to end workflow to onboarding an Azure account using APIs, see [Automate Azure Cloud Account Onboarding](/prisma-cloud/docs/cspm/azure-account-onboarding/).\n For common operations related to cloud accounts, see [Cloud Accounts (All)](/prisma-cloud/api/cspm/cloud-accounts-all/).\n"
paths:
  /cas/v1/azure_account:
    post:
      tags:
      - Cloud Accounts (Azure)
      summary: Add Cloud Account (Azure)
      description: "Onboard a new azure cloud account onto the Prisma Cloud platform. \n\n**Prerequisite**: Generate and download the Terraform template by calling Generate and Download the Azure Terraform Template. \n\n**Note**: For Azure China, Terraform template generation is not supported. You must create the app registration and the required roles manually."
      operationId: add-azure-cloud-account
      parameters:
      - name: skipStatusChecks
        in: query
        description: true = Skip account status checks to improve response time
        required: false
        schema:
          type: boolean
      requestBody:
        $ref: '#/components/requestBodies/AzureCloudAccountRequestModel'
      responses:
        '200':
          description: successful operation
        '400':
          description: duplicate_cloud_account_name / duplicate_cloud_account / invalid_account_id_format / duplicate_cloud_account_needs_upgrade / cannot_select_zero_account_groups / invalid_account_group_ids
        '404':
          description: invalid_account_type
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/azure_account/{account_id}:
    put:
      tags:
      - Cloud Accounts (Azure)
      summary: Update Cloud Account (Azure)
      description: Update the cloud account that has been onboarded onto the Prisma Cloud platform.
      operationId: update-azure-cloud-account
      parameters:
      - name: account_id
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      - name: skipStatusChecks
        in: query
        description: true = Skip account status checks to improve response time
        required: false
        schema:
          type: boolean
      requestBody:
        $ref: '#/components/requestBodies/AzureCloudAccountRequestModel'
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_account_id_format / duplicate_cloud_account_name / duplicate_cloud_account / cannot_select_zero_account_groups / invalid_account_group_ids
        '404':
          description: invalid_account_type
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/cloud_account/status/azure:
    post:
      tags:
      - Cloud Accounts (Azure)
      summary: Get Cloud Account Status (Azure)
      description: Lists the status of a Azure Cloud account. You can use this API to verify the status of the security capabilities which you will be onboarding on Prisma Cloud.
      operationId: get-azure-cloud-account-status
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AzureCloudAccountRequestModel'
      responses:
        '200':
          description: successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CloudAccountStatus'
        '400':
          description: bad_request
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cloud-accounts-manager/v1/cloudAccounts/azureAccounts/{account_id}/ancestors:
    post:
      tags:
      - Cloud Accounts (Azure)
      summary: List Ancestors (Azure)
      description: Lists the ancestors of the given Azure management groups and subscriptions for the specified cloud account (Azure tenant) ID. Each resource ID in the request body is either a management group ID or a subscription ID. A successful response returns an array of ancestors for each given resource ID.
      operationId: get-ancestors-for-given-subscriptions-and-management-groups
      parameters:
      - name: account_id
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Resources'
        description: Cloud service provider resource IDs
        required: true
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                uniqueItems: true
                items:
                  $ref: '#/components/schemas/AzureAncestorsModel'
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cloud-accounts-manager/v1/cloudAccounts/azureAccounts/{parent_id}/children:
    post:
      tags:
      - Cloud Accounts (Azure)
      summary: List Children of Parent (Azure)
      description: Lists all the children, both management groups and subscriptions, under the given parent. A parent can be either an Azure tenant or a management group.
      operationId: list-children-under-parent
      parameters:
      - name: parent_id
        in: path
        description: Parent Resource ID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AzureListChildrenRequestModel'
        description: Azure cloud account parameters
        required: true
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AzureHierarchyNodeModel'
        '400':
          description: bad_request / unauthorized_access
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/azure_template:
    post:
      tags:
      - Cloud Accounts (Azure)
      summary: Generate and Download the Terraform template (Azure)
      description: 'Generates the Azure Terraform template. The generated Terraform template includes the permissions based on selected features. The terraform template can be used to create an app registration and required roles on the Azure Portal.


        **Note**: This feature is available only for Prisma Commercial and Government stacks.'
      operationId: generate-template-link
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AzureTemplateGenRequest'
        required: true
      responses:
        '200':
          description: Template Generated Successfully
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '401':
          description: Unauthorized Access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '403':
          description: Tenant License Expired
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '405':
          description: Wrong Http Method
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '429':
          description: Rate Limit Exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      x-public: 'true'
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
components:
  schemas:
    CloudAccountStatus:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        status:
          type: string
        statusMessage:
          $ref: '#/components/schemas/AccountStatusMessage'
    AzureAncestorsModel:
      type: object
      properties:
        resourceId:
          type: string
          description: Resource ID
        ancestors:
          type: array
          description: List of ancestors
          items:
            $ref: '#/components/schemas/AzureHierarchyNodeModel'
      description: Model for Azure GetAncestors API Response
    AzureHierarchySelectionModel:
      type: object
      properties:
        resourceId:
          type: string
          example: root
          description: 'To get the list of resource IDs and its details, Refer [List Children of Parent (Azure)](/prisma-cloud/api/cspm/list-children-under-parent/) '
        displayName:
          type: string
          example: Root
          description: To get the display name of resource, Refer [List Children of Parent (Azure)](/prisma-cloud/api/cspm/list-children-under-parent/)
        nodeType:
          type: string
          description: Member account node type. Supported values are SUBSCRIPTION, MANAGEMENT_GROUP, or TENANT
        selectionType:
          type: string
          description: "Organization Member accounts Selection type. \n\n**ALL**: Include the resource and all its children \n\n**INCLUDE**: Include the specified resource\n\n**EXCLUDE**: Exclude the specified resource"
          enum:
          - ALL
          - INCLUDE
          - EXCLUDE
      description: Model for HierarchySelection for Azure
    AzureCloudAccountRequestModelCloudAccount:
      type: object
      required:
      - accountType
      - name
      properties:
        accountId:
          type: string
          description: 'Azure Subscription ID. Required field for accountType: **account**


            '
        accountType:
          type: string
          description: Cloud Account Type
          enum:
          - account
          - tenant
        enabled:
          type: boolean
          description: True to enable ingestion of logs to Prisma Cloud. The default value is True. \n **NOTE:** Ingestion will be stopped if enabled is set to False
        name:
          type: string
          description: Name to be used for the account on the Prisma Cloud platform (must be unique)
        groupIds:
          type: array
          description: Account Group Ids for this account.
          items:
            type: string
    Feature:
      type: object
      properties:
        name:
          type: string
          example: Remediation
          description: Feature name obtained from **[Fetch Supported Features endpoint](/prisma-cloud/api/cspm/fetch-supported-features)**
        state:
          type: string
          description: Feature state. Whether to be enabled or disabled
          enum:
          - enabled
          - disabled
        defaultMemberState:
          type: string
          description: Enable or disable the feature for all the member accounts linked to this organization. You can enable or disable the defaultMemberState only if the feature state is enabled for the organization. Applicable only for Serverless Function Scanning and Agentless Workload Scanning features.
          enum:
          - enabled
          - disabled
      description: Model for Feature
    Resources:
      type: object
      properties:
        resourceIds:
          type: array
          description: Array of resource IDs (Subscription and/or Management Group IDs)
          uniqueItems: true
          items:
            type: string
      description: Resources Model for Identifying Ancestors
    AzureCloudAccountRequestModel:
      type: object
      required:
      - clientId
      - cloudAccount
      - environmentType
      - key
      - tenantId
      properties:
        cloudAccount:
          $ref: '#/components/schemas/AzureCloudAccountRequestModelCloudAccount'
        clientId:
          type: string
          description: Application (Client) ID
        environmentType:
          type: string
          description: "* **azure** -  Commercial deployment type.\nApplicable for Prisma Commercial and Government stacks\n\n * **azure_gov** - Government deployment type.\nApplicable for Prisma Commercial and Government stacks..\n\n * **azure_china** - Applicable for Prisma China Stack."
          enum:
          - azure
          - azure_gov
          - azure_china
        key:
          type: string
          description: Application key/client secret
        monitorFlowLogs:
          type: boolean
          description: If set to true, it ingests Network Security Group Flow Logs to Prisma Cloud
        servicePrincipalId:
          type: string
          description: Service Principal ID
        tenantId:
          type: string
          description: Directory (Tenant) ID
        features:
          type: array
          description: Features to be enabled and/ or disabled. To get a list of all the supported features, call **[Fetch Supported Features endpoint](/prisma-cloud/api/cspm/fetch-supported-features)**
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Feature'
        defaultAccountGroupId:
          type: string
          description: "*Required only for accountType: **tenant**.*\n\n This is the Default Account Group ID for the Azure Tenant and its Management Groups/Subscriptions."
        hierarchySelection:
          type: array
          description: "*Required only for accountType: **tenant**.*\n\n Include or Exclude a list of Azure Management Groups and Azure Subscriptions to onboard under this Tenant."
          items:
            $ref: '#/components/schemas/AzureHierarchySelectionModel'
        rootSyncEnabled:
          type: boolean
          description: "*Applicable only for accountType: **tenant***\n\n In order to onboard the **tenant** and its associated **management groups** and **subscriptions**, ```rootSyncEnabled``` must be set to ```true```"
        accountGroupMode:
          type: string
          description: '*Applicable only for role: **System Admin** and account type: **tenant** when ```rootSyncEnabled``` is set to ```true```.*


            * **MANUAL** - Create account groups manually in Prisma Cloud.


            * **AUTOMAP** - Automatically creates the account groups in Prisma Cloud replicating the hierarchy in Azure Cloud.'
          enum:
          - MANUAL
          - AUTOMAP
      description: Model containing the request for Azure Standalone and Tenant Cloud Account
    AccountStatusMessage:
      type: object
      properties:
        message:
          type: string
        staticMessage:
          type: boolean
    AzureListChildrenRequestModelCloudAccount:
      type: object
      required:
      - accountType
      properties:
        accountId:
          type: string
          description: Azure account ID
        accountType:
          type: string
          description: Cloud Account Type
          enum:
          - tenant
    AzureListChildrenRequestModel:
      type: object
      required:
      - clientId
      - cloudAccount
      - environmentType
      - key
      - rootSyncEnabled
      - servicePrincipalId
      - tenantId
      properties:
        cloudAccount:
          $ref: '#/components/schemas/AzureListChildrenRequestModelCloudAccount'
        clientId:
          type: string
          description: Application (Client) ID
        environmentType:
          type: string
          description: "* **azure** -  Commercial deployment type.\nApplicable for Prisma Commercial and Government stacks\n\n * **azure_gov** - Government deployment type.\nApplicable for Prisma Commercial and Government stacks..\n\n * **azure_china** - Applicable for Prisma China Stack."
          enum:
          - azure
          - azure_gov
          - azure_china
        key:
          type: string
          description: Application key/client secret
        monitorFlowLogs:
          type: boolean
          description: Automatically ingest flow logs
        servicePrincipalId:
          type: string
          description: Service Principal ID
        tenantId:
          type: string
          description: Directory (Tenant) ID
        rootSyncEnabled:
          type: boolean
          description: true = Azure tenant has children. Must be true.
      description: Model containing the request for List children of Azure Tenant Cloud Account
    AzureHierarchyNodeModel:
      type: object
      properties:
        id:
          type: string
          description: Node ID
        type:
          type: string
          description: Node type
          enum:
          - TENANT
          - MANAGEMENT_GROUP
          - ACCOUNT
        displayName:
          type: string
          description: Display name
        parent:
          type: string
          description: Parent
        hasChild:
          type: boolean
          description: true = Has child
      description: Model for AzureNode in the Tenant Hierarchy
    AzureTemplateGenRequest:
      required:
      - accountType
      - tenantId
      type: object
      properties:
        accountType:
          type: string
          description: "Cloud account type. \n\n **account** = Azure Subscription \n\n**tenant** = Azure Tenant"
          example: null
          enum:
          - account
          - tenant
        subscriptionId:
          type: string
          description: "*Required field for accountType: **account***.\n\n Azure Subscription ID"
          example: null
        tenantId:
          type: string
          description: Azure Directory (Tenant) ID
          example: null
        rootSyncEnabled:
          type: boolean
          description: "*Applicable only for accountType: **tenant***\n\n In order to onboard the account type **tenant** and its associated **management groups** and **subscriptions**, ```rootSyncEnabled``` must be set to ```true```"
          example: null
        features:
          uniqueItems: true
          type: array
          description: "Features for which the permissions should be generated and included in the template. \n\n To get a list of all the supported features, call **[Get Supported Features](/prisma-cloud/api/cspm/fetch-supported-features)** endpoint"
          example:
          - Remediation
          items:
            type: string
            description: "Features for which the permissions should be generated and included in the template. \n\n To get a list of all the supported features, call **[Get Supported Features](/prisma-cloud/api/cspm/fetch-supported-features)** endpoint"
            example: '["Remediation"]'
        deploymentType:
          type: string
          description: "*Applicable only for Prisma Commercial and Government stacks* \n\n**azure** = Commercial deployment type\n\n**azure_gov** = Government deployment type"
          example: null
          enum:
          - azure
          - azure_gov
      example: null
    ApiError:
      type: object
      properties:
        status:
          type: string
          example: null
          enum:
          - 100 CONTINUE
          - 101 SWITCHING_PROTOCOLS
          - 102 PROCESSING
          - 103 CHECKPOINT
          - 200 OK
          - 201 CREATED
          - 202 ACCEPTED
          - 203 NON_AUTHORITATIVE_INFORMATION
          - 204 NO_CONTENT
          - 205 RESET_CONTENT
          - 206 PARTIAL_CONTENT
          - 207 MULTI_STATUS
          - 208 ALREADY_REPORTED
          - 226 IM_USED
          - 300 MULTIPLE_CHOICES
          - 301 MOVED_PERMANENTLY
          - 302 FOUND
          - 302 MOVED_TEMPORARILY
          - 303 SEE_OTHER
          - 304 NOT_MODIFIED
          - 305 USE_PROXY
          - 307 TEMPORARY_REDIRECT
          - 308 PERMANENT_REDIRECT
          - 400 BAD_REQUEST
          - 401 UNAUTHORIZED
          - 402 PAYMENT_REQUIRED
          - 403 FORBIDDEN
          - 404 NOT_FOUND
          - 405 METHOD_NOT_ALLOWED
          - 406 NOT_ACCEPTABLE
          - 407 PROXY_AUTHENTICATION_REQUIRED
          - 408 REQUEST_TIMEOUT
          - 409 CONFLICT
          - 410 GONE
          - 411 LENGTH_REQUIRED
          - 412 PRECONDITION_FAILED
          - 413 PAYLOAD_TOO_LARGE
          - 413 REQUEST_ENTITY_TOO_LARGE
          - 414 URI_TOO_LONG
          - 414 REQUEST_URI_TOO_LONG
          - 415 UNSUPPORTED_MEDIA_TYPE
          - 416 REQUESTED_RANGE_NOT_SATISFIABLE
          - 417 EXPECTATION_FAILED
          - 418 I_AM_A_TEAPOT
          - 419 INSUFFICIENT_SPACE_ON_RESOURCE
          - 420 METHOD_FAILURE
          - 421 DESTINATION_LOCKED
          - 422 UNPROCESSABLE_ENTITY
          - 423 LOCKED
          - 424 FAILED_DEPENDENCY
          - 425 TOO_EARLY
          - 426 UPGRADE_REQUIRED
          - 428 PRECONDITION_REQUIRED
          - 429 TOO_MANY_REQUESTS
          - 431 REQUEST_HEADER_FIELDS_TOO_LARGE
          - 451 UNAVAILABLE_FOR_LEGAL_REASONS
          - 500 INTERNAL_SERVER_ERROR
          - 501 NOT_IMPLEMENTED
          - 502 BAD_GATEWAY
          - 503 SERVICE_UNAVAILABLE
          - 504 GATEWAY_TIMEOUT
          - 505 HTTP_VERSION_NOT_SUPPORTED
          - 506 VARIANT_ALSO_NEGOTIATES
          - 507 INSUFFICIENT_STORAGE
          - 508 LOOP_DETECTED
          - 509 BANDWIDTH_LIMIT_EXCEEDED
          - 510 NOT_EXTENDED
          - 511 NETWORK_AUTHENTICATION_REQUIRED
        timestamp:
          type: string
          format: date-time
          example: null
        message:
          type: string
          example: null
        debugMessage:
          type: string
          example: null
      example: null
  requestBodies:
    AzureCloudAccountRequestModel:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/AzureCloudAccountRequestModel'
      description: Cloud Account
      required: true
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
x-refined-from:
- palo-alto-cspm-cloudaccountonboardingmicroservices-openapi.json
- palo-alto-cspm-cloudaccountsmicroservice-openapi.json