openapi: 3.2.0
info:
  title: public dlp DLP API API
  version: 1.0.0
  description: DLP Public API
  license:
    name: MIT
    url: https://opensource.org/license/mit
  contact:
    email: support@paloaltonetworks.com
    name: Palo Alto Networks Technical Support
    url: https://support.paloaltonetworks.com
servers:
- url: https://api.dlp.paloaltonetworks.com
  description: Prod host
security:
- JWTAuth: []
tags:
- name: DLP API
  description: DLP API
paths:
  /v1/public/report/{reportId}:
    summary: Get DLP Report
    description: Get DLP report
    parameters:
    - name: fetchSnippets
      description: (Optional) Boolean field when set to true, retrieves snippets from the DLP report.
      schema:
        type: boolean
      in: query
    get:
      tags:
      - DLP API
      parameters:
      - name: reportId
        description: ID of the retrieved report
        schema:
          type: string
        in: path
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScanContentResponse'
              examples:
                sample report:
                  value:
                    txn_id: '483332512'
                    report_id: '483332512'
                    data_profile_id: '11995014'
                    data_profile_name: Sensitive Content
                    type: basic
                    tenant_id: '7830962012064884736'
                    fileSha: 90d068df2381ebd8342c99cf59907e7c9fc7ab3d7c4c6fdc2a3d814eb7ed374f
                    file_name: google_finance_template_1mb.txt
                    file_type: txt
                    file_size_in_bytes: 1005626
                    extracted_file_size_in_bytes: 1005635
                    detection_time: 10/15/2020 21:16:24 UTC
                    data_pattern_rule_1_verdict: MATCHED
                    scanContentRawReport:
                      data_pattern_rule_1_results:
                      - data_pattern_id: 5ee3c51c99025d000161ab9a
                        version: 1
                        name: Bank - American Bankers Association Routing Number - ABA
                        technique: regex
                        type: predefined
                        strict_detection_frequency: 0
                        proximity_detection_frequency: 0
                        detection_frequency: 0
                        unique_strict_detection_frequency: 0
                        unique_checksum_detection_frequency: 0
                        unique_proximity_detection_frequency: 0
                        unique_detection_frequency: 0
                        weighted_frequency: 0
                        high_confidence_frequency: 0
                        medium_confidence_frequency: 0
                        low_confidence_frequency: 0
                        unique_high_confidence_frequency: 0
                        unique_medium_confidence_frequency: 0
                        unique_low_confidence_frequency: 0
                        state: EVALUATED
                      - data_pattern_id: 5ee3c51c99025d000161aba6
                        version: 1
                        name: Voyager Credit Card
                        technique: regex
                        type: predefined
                        strict_detection_frequency: 0
                        proximity_detection_frequency: 0
                        detection_frequency: 0
                        unique_strict_detection_frequency: 0
                        unique_checksum_detection_frequency: 0
                        unique_proximity_detection_frequency: 0
                        unique_detection_frequency: 0
                        weighted_frequency: 0
                        high_confidence_frequency: 0
                        medium_confidence_frequency: 0
                        low_confidence_frequency: 0
                        unique_high_confidence_frequency: 0
                        unique_medium_confidence_frequency: 0
                        unique_low_confidence_frequency: 0
                        state: EVALUATED
                      - data_pattern_id: 5ee3c51d99025d000161ac52
                        version: 1
                        name: NationalId - US Social Security Number - SSN
                        technique: regex
                        type: predefined
                        strict_detection_frequency: 0
                        proximity_detection_frequency: 3
                        detection_frequency: 3
                        unique_strict_detection_frequency: 0
                        unique_checksum_detection_frequency: 0
                        unique_proximity_detection_frequency: 3
                        unique_detection_frequency: 3
                        weighted_frequency: 0
                        high_confidence_frequency: 3
                        medium_confidence_frequency: 0
                        low_confidence_frequency: 3
                        unique_high_confidence_frequency: 3
                        unique_medium_confidence_frequency: 0
                        unique_low_confidence_frequency: 3
                        matched_confidence_level: high
                        state: EVALUATED
                report with snippets:
                  value:
                    fileSha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
                    scanContentRawReport:
                      data_pattern_rule_1_results:
                      - detections:
                        - left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
                          right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
                          detection: '*******00'
                          original_text: '*******00'
                          origOffSet: 75
                          textLength: 0
                        - left: 'HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID *******1827 *******8911 *******8796 visa 4556501518562241 4929091695478411 aba '
                          right: ' *****3532 ssn 098-07-33 16 480-33-1945 Canada SIN *** *** 425 *****3197 Australia Tax ID 45322 1716 98754015 Access Key ID 022QF06E7MXBSH9DHM02 AWS Secret Key kWcrlUX5JEDGM/LtmEENI/ aVmYvHNif5zB+d9+c'
                          detection: '*******55'
                          original_text: '*******55'
                          origOffSet: 446
                          textLength: 0
                        - left: "\n\n\n\n\n\n tax id number "
                          right: ' abs cupp

                            IBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-***'
                          detection: '***-**-**99'
                          original_text: '***-**-**99'
                          origOffSet: 21
                          textLength: 0
                        data_pattern_id: 6374e1b4dee31d91c40b179d
                        version: 1
                        name: National Id - US Social Security Number - SSN
                        technique: regex
                        type: predefined
                        strict_detection_frequency: 0
                        proximity_detection_frequency: 7
                        detection_frequency: 7
                        unique_strict_detection_frequency: 0
                        unique_checksum_detection_frequency: 0
                        unique_proximity_detection_frequency: 7
                        unique_detection_frequency: 7
                        weighted_frequency: 0
                        high_confidence_frequency: 7
                        medium_confidence_frequency: 0
                        low_confidence_frequency: 7
                        unique_high_confidence_frequency: 7
                        unique_medium_confidence_frequency: 0
                        unique_low_confidence_frequency: 7
                        matched_confidence_level: high
                        state: EVALUATED
                        high_confidence_detections: {}
                        medium_confidence_detections: {}
                        low_confidence_detections: {}
                        edm_columns: []
                    txn_id: '163570374'
                    report_id: '163570374'
                    data_profile_id: '11995044'
                    data_profile_version: 1
                    data_profile_name: PII
                    type: basic
                    tenant_id: '5886928188517009408'
                    file_name: SSNpattern
                    file_type: pdf
                    file_size_in_bytes: 930
                    extracted_file_size_in_bytes: 937
                    detection_time: 02/10/2024 23:34:14 GMT
                    action: block
                    data_pattern_rule_1_verdict: MATCHED
          description: OK
        '400':
          description: Bad Request. Got an invalid JSON.
        '401':
          description: Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, ID, or other invalid authentication parameters.
        '403':
          description: Forbidden access. The provided API Key does not have the required permissions to run this API.
        '500':
          description: Internal server error. A unified status for API communication type errors.
      security:
      - JWTAuth: []
      summary: Get Reports
      description: Get report
      operationId: getReport
  /v1/api/incidents/{incidentID}/assignee:
    description: Assign Incidents
    servers:
    - url: https://api.dlp.paloaltonetworks.com
      description: ''
    put:
      requestBody:
        description: UUID of assignee
        content:
          application/json:
            schema:
              type: string
            examples:
              UUID of assignee:
                value: 00d53ebf-c386-4b95-ad05-6819517c3450
        required: true
      tags:
      - DLP API
      parameters:
      - name: region
        description: region the incident are belongs to (default to us)
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
        in: query
        required: false
      - name: incidentID
        description: ID of the Incident to be updated
        schema:
          type: string
        in: path
        required: true
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - JWTAuth: []
      summary: Assign Incidents
      operationId: updateIncidentAssignee
  /v1/api/incidents/{incidentID}/notes:
    description: Update incident with notes
    servers:
    - url: https://api.dlp.paloaltonetworks.com
      description: ''
    put:
      operationId: updateIncidentNotes
      requestBody:
        content:
          application/json:
            schema:
              type: string
            examples:
              sample notes:
                value: This is a note for incident
        required: true
      tags:
      - DLP API
      parameters:
      - name: incidentID
        description: ID of the Incident to be updated
        schema:
          type: string
        in: path
        required: true
      - name: region
        description: region the incident belongs to (default to us)
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
        in: query
        required: false
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - JWTAuth: []
      summary: Update Inicident Note
    delete:
      operationId: deleteIncidentNotes
      tags:
      - DLP API
      parameters:
      - name: incidentID
        description: ID of the Incident
        schema:
          type: string
        in: path
        required: true
      - name: region
        description: region the incident belongs to (default to us)
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
        in: query
        required: false
      responses:
        '200':
          description: notes are deleted
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      summary: Remove Incident Notes
  /v1/api/incidents/{incidentID}/resolution-status:
    description: Update incident resolution status
    servers:
    - url: https://api.dlp.paloaltonetworks.com
      description: ''
    put:
      requestBody:
        content:
          application/json:
            schema:
              type: string
            examples:
              resolution status:
                value: assigned
        required: true
      tags:
      - DLP API
      parameters:
      - name: incidentID
        description: ID of the Incident to be updated
        schema:
          type: string
        in: path
        required: true
      - name: region
        description: region that incident belongs to (default to us)
        schema:
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
          type: string
        in: query
        required: false
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - JWTAuth: []
      summary: Update Incident Resolution
      operationId: updateIncidentResolutionStatus
  /v1/api/incidents/assignee:
    summary: Get All Assignees
    description: Get All Assignees
    servers:
    - url: https://api.dlp.paloaltonetworks.com
      description: ''
    get:
      operationId: getIncidentAssignees
      tags:
      - DLP API
      responses:
        '200':
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/IncidentAssignee'
              examples:
                assignees:
                  value:
                  - id: 00d53ebf-c386-4b95-ad05-6819517c3450
                    tenantId: '5886928188517009408'
                    firstName: test u
                    lastName: test
                    emailAddress: test@test.com
                    status: ACTIVE
                    createdAt: 2024-Jan-11 23:16:33 UTC
                    updatedAt: 2024-Feb-14 19:13:01 UTC
                  - id: 133b9b0d-6e64-40ca-abec-15ff3b906b80
                    tenantId: '5886928188517009408'
                    firstName: user
                    lastName: my last name
                    emailAddress: user1@test.com
                    status: ACTIVE
                    createdAt: 2023-Aug-03 21:23:39 UTC
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - JWTAuth: []
      summary: Get All Assignees
    put:
      operationId: createOrUpdateIncidentAssignees
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IncidentAssigneeDTO'
        required: true
      tags:
      - DLP API
      responses:
        '200':
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Internal server error
      security:
      - JWTAuth: []
      summary: Create or Update Incident Assignee
  /v1/api/incidents/assignee/{assigneeId}:
    get:
      tags:
      - DLP API
      parameters:
      - name: assigneeId
        description: The ID of the assignee for the incident.
        schema:
          type: string
        in: path
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentAssignee'
              examples:
                assignee:
                  value:
                    id: 00d53ebf-c386-4b95-ad05-6819517c3450
                    tenantId: '5886928188517009408'
                    firstName: test
                    lastName: test
                    emailAddress: test@test.com
                    status: ACTIVE
                    createdAt: 2024-Jan-11 23:16:33 UTC
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - JWTAuth: []
      summary: Get Assignee by ID
      operationId: getIncidentAssigneesById
  /v2/api/incidents/{incidentID}:
    description: Get Incident Details
    servers:
    - url: https://api.dlp.paloaltonetworks.com
      description: ''
    parameters:
    - name: region
      description: region(default to us)
      schema:
        enum:
        - us
        - eu
        - uk
        - jp
        - in
        - ap
        - ca
        - au
        - par
        type: string
      in: query
    get:
      tags:
      - DLP API
      parameters:
      - examples:
          IncidentID Example:
            value: 3fb38abe-a83b-44e5-99d5-4bec3765bba6
        name: incidentID
        description: ID of the incident
        schema:
          type: string
        in: path
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentResponseDTO'
              examples:
                incident detail:
                  value:
                    incident_id: 1a762308-3735-4d29-8edd-4595d4e3f982
                    tenant_id: '5886928188517009408'
                    report_id: '1107089697'
                    data_profile_id: 11995044
                    data_profile_name: PII
                    file_sha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
                    file_name: SSNpattern
                    incident_creation_time: 2024-Jan-18 21:46:54 UTC
                    channel: ngfw
                    source: ngfw
                    action: alert
                    match_info:
                      6374e1b4dee31d91c40b1705:
                        name: Driver License - Slovenia
                        version: 1
                        lcf: 5
                        hcf: 0
                        mcf: 0
                        ulcf: 5
                        uhcf: 0
                        umcf: 0
                        detection_technique: regex
                      6374e1b4dee31d91c40b1708:
                        name: Driver License - Canada
                        version: 1
                        lcf: 13
                        hcf: 0
                        mcf: 0
                        ulcf: 13
                        uhcf: 0
                        umcf: 0
                        detection_technique: regex
                      6374e1b4dee31d91c40b1709:
                        name: Driver License - US
                        version: 1
                        lcf: 17
                        hcf: 0
                        mcf: 0
                        ulcf: 17
                        uhcf: 0
                        umcf: 0
                        detection_technique: regex
                    snippets:
                      6374e1b4dee31d91c40b1705:
                        version: 1
                        low_confidence_detections:
                        - left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
                          right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
                          detection: '*******00'
                          original_text: '*******00'
                          origOffSet: 75
                          textLength: 0
                        - left: 'HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID *******1827 *******8911 *******8796 visa 4556501518562241 4929091695478411 aba '
                          right: ' *****3532 ssn 098-07-33 16 480-33-1945 Canada SIN *** *** 425 *****3197 Australia Tax ID 45322 1716 98754015 Access Key ID 022QF06E7MXBSH9DHM02 AWS Secret Key kWcrlUX5JEDGM/LtmEENI/ aVmYvHNif5zB+d9+c'
                          detection: '*******55'
                          original_text: '*******55'
                          origOffSet: 446
                          textLength: 0
                        - left: 'BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID *******1827 *******8911 *******8796 visa 4556501518562241 4929091695478411 aba *******55 '
                          right: ' ssn 098-07-33 16 480-33-1945 Canada SIN *** *** 425 *****3197 Australia Tax ID 45322 1716 98754015 Access Key ID 022QF06E7MXBSH9DHM02 AWS Secret Key kWcrlUX5JEDGM/LtmEENI/ aVmYvHNif5zB+d9+ct ;5301250'
                          detection: '*****3532'
                          original_text: '*****3532'
                          origOffSet: 456
                          textLength: 0
                      6374e1b4dee31d91c40b1708:
                        version: 1
                        low_confidence_detections:
                        - left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
                          right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
                          detection: '*******00'
                          original_text: '*******00'
                          origOffSet: 75
                          textLength: 0
                        - left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | "
                          right: ' CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1030 ******10'
                          detection: '*****5341'
                          original_text: '*****5341'
                          origOffSet: 113
                          textLength: 0
                        - left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA "
                          right: ' | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1'
                          detection: '*****3839'
                          original_text: '*****3839'
                          origOffSet: 101
                          textLength: 0
                      6374e1b4dee31d91c40b1709:
                        version: 1
                        low_confidence_detections:
                        - left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip "
                          right: ' | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-**'
                          detection: '*******00'
                          original_text: '*******00'
                          origOffSet: 75
                          textLength: 0
                        - left: "\n\n\n\n\n\n tax id number ***-**-**99 abs cupp\nIBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402\nHETU number "
                          right: '-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-****-6246 SHAKAI HOSHŌ ZEI BANGŌ SEIDO MAINANBA ****-****-6333

                            UK Tax UTR ******1030 ******1031 NINO GP 32 76 63 *****280B Germany Tax ID ***'
                          detection: '******'
                          original_text: '******'
                          origOffSet: 164
                          textLength: 0
                        - left: "\n\n\n\n\n\n tax id number "
                          right: ' abs cupp

                            IBAN CH9300762011623852957 cusip *******00 | *****0BG4 DEA *****3839 | *****5341 CLIA 24C3872984 | 05D0911402

                            HETU number ******-856E | *******0490

                            CPF | **************1-30 CNPJ

                            *-****-***'
                          detection: '***-**-**99'
                          original_text: '***-**-**99'
                          origOffSet: 21
                          textLength: 0
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - JWTAuth: []
      summary: Get Incident Details
      operationId: getIncident
  /v2/api/incidents:
    description: Get Bulk Incidents
    servers:
    - url: https://api.dlp.paloaltonetworks.com
      description: ''
    get:
      tags:
      - DLP API
      parameters:
      - name: ascending
        description: get the list of incident in ascending order or not(default false)
        schema:
          type: boolean
        in: query
        required: false
      - name: channel
        description: ngfw or prisma-access
        schema:
          enum:
          - ngfw
          - prisma-access
          type: string
        in: query
        required: false
      - name: end_time
        description: query incident until
        schema:
          format: date-time
          type: string
        in: query
        required: false
      - name: file_shas
        description: get incidents triggered by file hash. must be a comma separated list of one or more sha256 hashes of files
        schema:
          type: string
        in: query
        required: false
      - name: page_number
        description: page_number
        schema:
          format: int32
          type: integer
        in: query
        required: false
      - name: page_size
        description: page_size
        schema:
          format: int32
          type: integer
        in: query
        required: false
      - name: region
        description: region (defaults to us)
        schema:
          type: string
          enum:
          - us
          - eu
          - uk
          - jp
          - in
          - ap
          - ca
          - au
          - par
        in: query
        required: false
      - name: report_ids
        description: report_ids
        schema:
          type: array
          items:
            type: string
        in: query
        required: false
      - name: sort_by
        description: sort by. default sort by creation time
        schema:
          type: string
        in: query
        required: false
      - name: start_time
        description: start_time
        schema:
          format: date-time
          type: string
        in: query
        required: false
      - name: user_ids
        description: query by user ids
        schema:
          type: array
          items:
            type: string
        in: query
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentResponse'
              examples:
                incidentResponseExample:
                  value:
                    page:
                      size: 10
                      number: 1
                      total_elements: 290
                      total_pages: 29
                    resources:
                    - incident_id: 7c3dca3d-1c08-4147-b171-9faba84739d4
                      tenant_id: '5886928188517009408'
                      report_id: '1572154781'
                      data_profile_id: 11995044
                      data_profile_name: PII
                      file_sha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
                      file_name: SSNpattern
                      file_type: pdf
                      incident_creation_time: 2023-Dec-07 18:41:12 UTC
                      channel: ngfw
                      source: ngfw
                      action: alert
                    - incident_id: 81985a40-dae5-4e80-8147-678892ccfc00
                      tenant_id: '5886928188517009408'
                      report_id: '2968440380'
                      data_profile_id: 11995410
                      data_profile_name: Portugal_LNAME_high
                      file_sha: 6c25d79cd1dee00b3a6ee6bbb985dae6ee5bdfa31a8dfcffa241786c8c3893a7
                      file_name: test_portugal_LNAME.txt
                      file_type: txt
                      incident_creation_time: 2023-Dec-07 18:39:38 UTC
                      channel: ngfw
                      source: ngfw
                      action: alert
                    - incident_id: 08f014d8-ed13-490e-bfc4-7363f43a4af1
                      tenant_id: '5886928188517009408'
                      report_id: '1347859663'
                      data_profile_id: 11995355
                      data_profile_name: inline_timing_11_12_edm
                      file_sha: 6c8d18c544aba3b44cfa487d5020ec102a6317a6a5164e270bbecf6ea37df925
                      file_name: all_patterns_data_1_MB.txt
                      file_type: txt
                      incident_creation_time: 2023-Dec-06 19:39:46 UTC
                      channel: ngfw
                      source: ngfw
                      action: alert
                    - incident_id: 6c7d838a-1b25-44fe-8917-1ff760c0eae5
                      tenant_id: '5886928188517009408'
                      report_id: '3741398016'
                      data_profile_id: 11995295
                      data_profile_name: DemoWideNestedProfile
                      file_sha: a4d58aa3caeb73b56028f597de2b3263d64e2835f277f31c97be53bc76a29e47
                      file_name: SSNpattern
                      file_type: pdf
                      incident_creation_time: 2023-Dec-05 21:54:21 UTC
                      channel: ngfw
                      source: ngfw
                      action: alert
          description: OK
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '500':
          description: Internal server error
      security:
      - JWTAuth: []
      summary: Get Incidents
      operationId: getAllIncidentsV2
components:
  schemas:
    PageData:
      title: PageData
      type: object
      properties:
        number:
          format: int32
          type: integer
        size:
          format: int32
          type: integer
        total_elements:
          format: int32
          type: integer
        total_pages:
          format: int32
          type: integer
    IncidentResponse:
      title: PagedDataResponse<IncidentDTO>
      required:
      - page
      type: object
      properties:
        page:
          $ref: '#/components/schemas/PageData'
          description: ''
        resources:
          type: array
          items:
            $ref: '#/components/schemas/IncidentDTO'
    IncidentResponseDTO:
      title: IncidentResponseDTO
      type: object
      properties:
        action:
          description: Action taken on the incident.
          enum:
          - alert
          - block
          type: string
        app_id:
          description: Palo Alto Networks assigned Application ID.
          type: string
        app_name:
          description: The name of the application.
          type: string
        channel:
          description: The Palo Alto Networks channel that identified the incident.
          enum:
          - ngfw
          - prisma-access
          type: string
        data_profile_id:
          format: int64
          description: The UUID profile descriptor used to characterize the incident.
          type: integer
        data_profile_name:
          description: The data profile descriptor used to characterize the incident.
          type: string
        file_name:
          description: The analyzed file name.
          type: string
        file_sha:
          description: The analyzed file SHA hash.
          type: string
        file_type:
          description: The analyzed file type.
          type: string
        incident_creation_time:
          description: The time the incident first occurred.
          type: string
          example: yyyy-MMM-dd HH:mm:ss z
        incident_id:
          format: uuid
          description: The Palo Alto Networks automatically assigned incident ID.
          type: string
        report_id:
          description: The Palo Alto Networks automatically assigned report ID that you can use to retrieve reports.
          type: string
        source:
          description: The Palo Alto Networks source that identified the incident.
          type: string
        tenant_id:
          description: The TSG enabled tenant used to identify the Incident.
          type: string
        user:
          description: The user assosciated with te incident.
          type: string
        incident_feedback_status:
          description: Current status of the feedback assosicated with the incident.
          type: string
        incident_notes:
          description: User defined notes for the incident.
          type: string
        resolution_status:
          description: Resolution status from Enterprise DLP status.
          type: string
        assignee_id:
          description: Automatically assigned ID of the assignee.
          type: string
        session_key:
          type: string
          description: Specifies a session key assosciated with the incident.
        snippets:
          description: A JSON structure containing snippet data, if snippets are not enabled, the field returns as null.
          type: string
        match_info:
          $ref: '#/components/schemas/MatchInfo'
          description: ''
          example: "\"65a0209ce36cd3480011d677\": {\n            \"name\": \"EDM - PatricksDataSet20240111\",\n            \"version\": 1,\n            \"lcf\": 10,\n            \"hcf\": 10,\n            \"mcf\": 0,\n            \"ulcf\": 10,\n            \"uhcf\": 10,\n            \"umcf\": 0,\n            \"detection_technique\": \"edm\",\n            \"edm_columns\": [\n                \"credit_card_number\",\n                \"social_security_number\"\n            ]\n        }\n"
      example:
        incident_id: 4adeefe4-8358-411e-8ba7-5f45e5625c58
        tenant_id: '5886928188517009408'
        report_id: '530470823'
        data_profile_id: 11995590
        data_profile_name: PatricksDPwEDM
        file_sha: 9d8ce237eff10b5ac4b4c8fed0d7988ca6cc4f090f90230acd8dad36fb7da636
        file_name: 100_rows_10_cols_tail.csv
        incident_creation_time: 2024-Jan-11 17:14:30 UTC
        channel: prisma-access
        source: prisma-access
        action: alert
        incident_notes: test notes
        resolution_status: Assigned
        assignee_id: 00d53ebf-c386-4b95-ad05-6819517c3450
        match_info:
          65a0209ce36cd3480011d677:
            name: EDM - PatricksDataSet20240111
            version: 1
            lcf: 10
            hcf: 10
            mcf: 0
            ulcf: 10
            uhcf: 10
            umcf: 0
            detection_technique: edm
            edm_columns:
            - credit_card_number
            - social_security_number
    MatchInfo:
      title: MatchInfo
      type: object
      properties:
        detection_technique:
          enum:
          - document_fingerprint
          - edm
          - file_property
          - ml
          - ml_document
          - regex
          - titus_tag
          - trainable_classifier
          - weighted_regex
          type: string
        edm_columns:
          uniqueItems: true
          type: array
          items:
            type: string
        hcf:
          format: int32
          description: high confidence frequency
          type: integer
        lcf:
          format: int32
          description: low confidence frequency
          type: integer
        mcf:
          format: int32
          description: medium confidence frequency
          type: integer
        name:
          description: pattern name
          type: string
        uhcf:
          format: int32
          description: unique high confidence frequency
          type: integer
        ulcf:
          format: int32
          description: unique low confidence frequency
          type: integer
        umcf:
          format: int32
          description: unique medium confidence frequency
          type: integer
        version:
          format: int32
          description: data pattern version
          type: integer
    IncidentAssignee:
      title: IncidentAssignee
      required:
      - status
      type: object
      properties:
        createdAt:
          description: create at
          type: string
          example: yyyy-MMM-dd HH:mm:ss z
        emailAddress:
          description: email address of the assignee
          type: string
        firstName:
          description: assignee first name
          type: string
        id:
          format: uuid
          description: ID of the assignee
          type: string
        lastName:
          description: assignee last name
          type: string
        status:
          description: active assignee or inactivate assignee
          enum:
          - ACTIVE
          - INACTIVE
          type: string
          example: '"ACTIVE" or "INACTIVE"'
        tenantId:
          description: dlp tenant id
          type: string
        updatedAt:
          description: ''
          type: string
          example: yyyy-MMM-dd HH:mm:ss z
    ScanContentResponse:
      title: ScanContentResponse
      type: object
      properties:
        data_pattern_rule_1_verdict:
          enum:
          - MATCHED
          - NOT_EVALUATED
          - NOT_MATCHED
          type: string
        data_pattern_rule_2_verdict:
          enum:
          - MATCHED
          - NOT_EVALUATED
          - NOT_MATCHED
          type: string
        data_profile_name:
          description: Profile of the detection rules
          type: string
        file_name:
          description: Name of the scanned file
          type: string
        report_id:
          description: ID of the retrieved report
          type: string
        scanContentRawReport:
          description: List of report data
          type: string
        tenant_id:
          description: DLP tenant ID
          type: string
    IncidentAssigneeDTO:
      title: IncidentAssigneeDTO
      required:
      - status
      - emailAddress
      - firstName
      - lastName
      type: object
      properties:
        emailAddress:
          description: Email address of the assignee
          type: string
        firstName:
          description: Assignees first name
          type: string
        id:
          format: uuid
          description: ID of the assignee(optional). If you do not provide an ID, the API will create a new assignee.
          type: string
        lastName:
          description: assignee last name
          type: string
        status:
          description: active assignee or inactivate assignee
          enum:
          - ACTIVE
          - INACTIVE
          type: string
          example: '"ACTIVE" or "INACTIVE"'
    IncidentDTO:
      title: IncidentDTO
      type: object
      properties:
        action:
          enum:
          - alert
          - block
          - none
          type: string
        app_id:
          type: string
        app_name:
          type: string
        channel:
          enum:
          - ngfw
          - prisma-access
          type: string
        data_profile_id:
          format: int64
          type: integer
        data_profile_name:
          type: string
        file_name:
          type: string
        file_sha:
          type: string
        file_type:
          type: string
        incident_creation_time:
          type: string
          example: yyyy-MMM-dd HH:mm:ss z
        incident_id:
          format: uuid
          type: string
        report_id:
          type: string
        source:
          type: string
        tenant_id:
          type: string
        user:
          type: string
  securitySchemes:
    JWTAuth:
      scheme: bearer
      type: http