openapi: 3.2.0 info: title: Palo Alto Networks IAM API version: '1.0' description: 'Operations tagged IAM across 3 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-iammicroservice-openapi.json, palo-alto-cspm-iamv2microservice-openapi.json. Each path carries the servers of the definition it was published in.' servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io tags: - name: IAM description: "Prisma Cloud identity and access management (IAM) security provides:\n* Visiblity—Query all relevant IAM entities\n* Gonvernance—Monitor your cloud environment for overly-used permissions\n* Response—Automatically remediate permissions\n\nThe IAM security endpoints enable you to investigate IAM data programmatically.\n\nSee [Primsa Cloud IAM Security](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-iam-security/what-is-prisma-cloud-iam-security.html)\nfor more information.\n\n\n### Error Handling\n\nLike other Prisma Cloud public API requests, the IAM security API requests return standard HTTP response codes. \nUnlike most other CSPM API error handling, IAM security API error responses do not include an [x-redlock-status](//prisma-cloud/api/cspm/api-errors)\nin the response header.\n\n\n### Pagination\n\nYou can control the number of items in a response for endpoints that support pagination. \nUse request parameter **limit** to control the maximum number of items in a response. If the response includes\n**data.nextPageToken**, use **data.nextPageToken** as the request parameter **pageToken** in a request for\nthe next page of data. \n\nThe following table summarizes the request parameters for pagination:\n\nRequest Parameter | Description \n-----------| -------\n**limit** | Maximum number of items to return in a page.\n**pageToken** | Use the **data.nextPageToken** value from the previous response object to return the next page of data.\n" paths: /api/v1/permission: post: tags: - IAM summary: Get Permissions description: 'Returns the results of a given [IAM query](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/iam-query.html). If you set the **Accept** request header to **appliation/json**, the response object contains an array of items with permissions data. The request parameter **limit** determines the number of items—for example, permissions—in the response object. If the amount of available data is greater than the specified **limit**, use the response object attribute **data.nextPageToken** as the request parameter **pageToken** in [Get Permissions Next Page](/prisma-cloud/api/cspm/get-next-permissions-page-with-post) to request the next page of data. If you set the **Accept** request header to **text/csv**, the response is a CSV that contains permissions details.' operationId: get-permissions-with-post requestBody: description: Model for Permission Search Request DTO content: application/json: schema: $ref: '#/components/schemas/PermissionSearchRequestDto' required: true security: - x-redlock-auth: [] responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PermissionSearchResponseDto' text/csv: schema: type: string '201': description: Created '401': description: Unauthorize '403': description: Forbidden '404': description: Not Found servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io /api/v1/permission/page: post: tags: - IAM summary: Get Permissions Next Page operationId: get-next-permissions-page-with-post description: Given a request parameter **pageToken**, returns the next page of permissions data. You can find the value for **pageToken** from the response object of a previous request to [Get Permissions](/prisma-cloud/api/cspm/get-permissions-with-post). requestBody: description: Model for Permission Search Page Request DTO content: application/json: schema: $ref: '#/components/schemas/PermissionSearchPageRequestDto' required: true security: - x-redlock-auth: [] responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PermissionSearchResultDataDto' text/plain: schema: $ref: '#/components/schemas/PermissionSearchResultDataDto' '201': description: Created '401': description: Unauthorize '403': description: Forbidden '404': description: Not Found servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io /api/v1/permission/access: post: tags: - IAM summary: Get Permissions Access description: "Given a permission ID and an \n[IAM query](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-rql-reference/rql-reference/iam-query.html),\nreturns data about the actual permission usage (last access).\n\n\nThe request parameter **limit** determines the number of items—that is, last access—in the response object. \n\n\nIf the amount of available data is greater than the \nspecified **limit**, use the response object attribute **data.nextPageToken** as the request parameter **pageToken** in \n[Get Permissions Access Next Page](/prisma-cloud/api/cspm/get-next-permissions-access-with-post) to request the\nnext page of data.\n" operationId: get-permissions-access-with-post requestBody: description: Model for Permission Access Request DTO content: application/json: schema: $ref: '#/components/schemas/PermissionAccessRequestDto' required: true security: - x-redlock-auth: [] responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PermissionAccessResponseDto' '201': description: Created '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io /api/v1/permission/access/page: post: tags: - IAM summary: Get Permissions Access Next Page description: "Given a request parameter **pageToken**, returns the next page of permissions data.\nYou can find the value for **pageToken** from the response object of a previous request to \n[Get Permissions Access](/prisma-cloud/api/cspm/get-permissions-access-with-post)\n" operationId: get-next-permissions-access-with-post requestBody: description: Model for Permission Access Page Request DTO content: application/json: schema: $ref: '#/components/schemas/PermissionAccessPageRequestDto' required: true security: - x-redlock-auth: [] responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PermissionAccessResultDataDto' '201': description: Created '401': description: Unauthorize '403': description: Forbidden '404': description: Not Found servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io /api/v1/permission/alert/remediation: post: tags: - IAM summary: Get Remediation operationId: get-remediation-with-post description: Returns a list of remediations for the specified alert IDs. requestBody: description: Model for RemediationRequestDto content: application/json: schema: $ref: '#/components/schemas/RemediationRequestDto' required: true security: - x-redlock-auth: [] responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/RemediationResponseDto' '201': description: Created '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io /api/v1/permission/alert/search: get: tags: - IAM summary: Get IAM Query operationId: get-rql-with-get description: Returns the IAM query for the specified alert ID. parameters: - name: alertId in: query description: alertId required: true schema: type: string security: - x-redlock-auth: [] responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/RqlResponseDto' '401': description: Unauthorize '403': description: Forbidden '404': description: Not Found servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io /api/v1/suggest: post: tags: - IAM summary: Get Query Suggestions operationId: get-suggestions-with-post description: Given a partial IAM query, returns suggestions to append to your query either to create a complete valid IAM query or to build a further partial query. Also indicates whether or not the query you input is already a valid IAM query. requestBody: description: Model for SuggestRequestDto content: application/json: schema: $ref: '#/components/schemas/SuggestRequestDto' required: true security: - x-redlock-auth: [] responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/SuggestResponseDto' '201': description: Created '401': description: Unauthorized '403': description: Forbidden '404': description: Not Found servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io /iam/api/v3/search/permission: post: tags: - IAM summary: Get Permissions V3 description: Returns a page of permissions and a page token for the next page if applicable operationId: search-permissions-v3 parameters: - name: limit in: query description: Query records limit required: false schema: type: integer format: int32 example: 5 requestBody: content: application/json: schema: $ref: '#/components/schemas/PermissionSearchRequestDtoV3' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PermissionSearchResponseDtoV3' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v4/search/permission: post: tags: - IAM summary: Get Permissions V4 description: Returns permissions grouped by requested fields and a page token for the next page if applicable. operationId: permission-search-v4 parameters: - name: limit in: query description: Query records limit required: false schema: type: integer format: int32 example: 100 requestBody: content: application/json: schema: $ref: '#/components/schemas/PermissionSearchV4RequestDto' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PermissionSearchV4ResponseDto' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v3/permission/{permission-id}/list_access: post: tags: - IAM summary: Get Permission Accesses V3 description: Returns a page of permission's last acceses and a page token for the next page if applicable operationId: permissions-accesses-v3 parameters: - name: permission-id in: path description: The permission id. Can be retrieved from search/permission api required: true schema: type: string description: The permission id. Can be retrieved from search/permission api example: 06c3cb4403ac276ff59679139b8e6afca2afe93100c8b39014f033ca0339ff0f example: 06c3cb4403ac276ff59679139b8e6afca2afe93100c8b39014f033ca0339ff0f - name: limit in: query description: Query records limit required: false schema: type: integer format: int32 example: 5 requestBody: content: application/json: schema: $ref: '#/components/schemas/PermissionAccessRequestDtoV3' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PermissionAccessResponseDtoV3' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v2/suggestion: post: tags: - IAM summary: Get Query Suggestions V2 description: Suggest auto completion for RQL and notify whether the current RQL is valid or not operationId: iam-suggest-v2 parameters: [] requestBody: content: application/json: schema: $ref: '#/components/schemas/SuggestRequestDto_2' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/SuggestResponseDto_2' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v2/search/iam_config: post: tags: - IAM summary: Get Permissions Role or Policy Definition V2 description: Returns the raw config (policy/role definition) which the permission was calculated from operationId: permission-raw-config-definition parameters: [] requestBody: content: application/json: schema: $ref: '#/components/schemas/PermissionRawDataRequestDto' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/PermissionRawDataResponseDto' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v1/asset/{asset-id}/related-asset: post: tags: - IAM summary: Get Cloud Identity Inventory (CII) Resource Related Assets description: Get assets related to Cloud Identity Inventory (CII) resource. operationId: cii-related-assets-v1 parameters: - name: asset-id in: path description: The asset UAI where you want to find it related assets required: true schema: type: string description: The asset UAI where you want to find it related assets example: 681390424b288d835f5cd03e7bfb0993 example: 681390424b288d835f5cd03e7bfb0993 - name: limit in: query description: Query client records limit, return MAX(0, MIN(client.limit, service.limit)) required: false schema: type: string description: Query client records limit, return MAX(0, MIN(client.limit, service.limit)) example: 5 example: 5 requestBody: content: application/json: schema: $ref: '#/components/schemas/CloudAssetRelatedAssetsRequestDto' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/CloudAssetRelatedAssetsResponseDto' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v2/alert/{alertId}/remediation_command: get: tags: - IAM summary: Get Remediation Command description: Get remediation command for an alert operationId: alert-remediation-command parameters: - name: alertId in: path description: The alert id required: true schema: type: string description: The alert id example: I-34537 example: I-34537 responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/RemediationResponseDtoV2' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v2/alert/{alertId}/query: get: tags: - IAM summary: Get IAM Query V2 description: Returns the query associated with an alert instance operationId: investigate-alert parameters: - name: alertId in: path description: The alert id required: true schema: type: string description: The alert id example: I-34537 example: I-34537 responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/RqlResponseDtoV2' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v1/assets/{assetId}/over-permissive-metadata: get: tags: - IAM summary: Get Least Privilege Access Metadata of an Asset description: Return a metadata and info about the improvement potential for an assert of Least Privilege Access. operationId: least-privilege-access-metadata-v1 parameters: - name: assetId in: path description: the UAI asset Id required: true schema: type: string description: the UAI asset Id example: 681390424b288d835f5cd03e7bfb0993 example: 681390424b288d835f5cd03e7bfb0993 responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/OverPermissiveMetadataResponseDto' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v1/assets/{assetId}/existing-least-privileged-access: get: tags: - IAM summary: Get Existing Least Privilege Access Suggestions for an Asset description: Suggest least privileged access from existing resources according to the asset. This configuration will minimize the amount of policies/roles used while preserve all the actions used in the last specified last X days operationId: existing-least-privilege-access-v1 parameters: - name: assetId in: path description: the UAI asset Id required: true schema: type: string description: the UAI asset Id example: 681390424b288d835f5cd03e7bfb0993 example: 681390424b288d835f5cd03e7bfb0993 - name: output_format in: query description: 'Output format type. One of: JSON / TERRAFORM/ CF' required: true schema: type: integer format: int32 example: JSON - name: lookback_duration_days in: query description: Amount of days to look back for used actions required: true schema: type: integer format: int32 example: 90 responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/ExistingLeastPrivilegedAccessResponseDto' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v1/assets/{assetId}/custom-least-privileged-access: get: tags: - IAM summary: Get New Least Privilege Access Suggestions for an Asset description: Generate Custom least privileged access configuration for the asset. Applying this configuration will minimize the amount of policies/roles used while preserve all the actions used in the last specified last X days operationId: custom-least-privilege-access-v1 parameters: - name: assetId in: path description: The UAI of the asset. required: true schema: type: string - name: output_format in: query description: 'Output format type. One of: JSON / TERRAFORM/ CF' required: true schema: type: string enum: - JSON - TERRAFORM - CF - name: lookback_duration_days in: query description: Amount of days to look back for used actions required: true schema: type: integer format: int32 example: 90 responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/CustomLeastPrivilegedAccessResponseDto' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v1/resources/{resourceId}/over-permissive-metadata: get: tags: - IAM summary: Get Least Privilege Access Metadata of a Resource description: Returns metadata describing whether an asset has potential for access optimization operationId: least-privilege-access-metadata-by-resource-v1 parameters: - name: resourceId in: path description: 'The resource ID. Encoded ARN for AWS, ID for Azure (examples: arn:aws:iam::accountId:role/roleName, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)' required: true schema: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/ExistingLeastPrivilegedAccessResponseDto' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v1/resources/{resourceId}/existing-least-privileged-access: get: tags: - IAM summary: Get Least Privilege Access Suggestions for a Resource description: Suggest the least privileged access based on existing IAM configurations. This configuration will minimize the number of policies/roles used preserving all the actions used in the last specified X days. operationId: existing-least-privilege-access-by-resource-v1 parameters: - name: resourceId in: path description: 'The resource ID. Encoded ARN for AWS, ID for Azure (examples: arn:aws:iam::accountId:role/roleName, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)' required: true schema: type: string description: the resource ID - name: output_format in: query description: Output format. required: true schema: type: string enum: - JSON - TERRAFORM - CF - name: lookback_duration_days in: query description: Amount of days to look back for used actions. required: true schema: type: integer format: int32 example: 90 responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/ExistingLeastPrivilegedAccessResponseDto' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io /iam/api/v1/resources/{resourceId}/custom-least-privileged-access: get: tags: - IAM summary: Get New Least Privilege Access Suggestions for a Resource description: Generate a custom least privileged access configuration for the resource. Applying this configuration will minimize the number of policies/roles used while preserving all the actions used in the last specified X days operationId: custom-least-privilege-access-by-resource-v1 parameters: - name: resourceId in: path description: 'The resource ID. Encoded ARN for AWS, ID for Azure (examples: arn:aws:iam::accountId:role/roleName, xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)' required: true schema: type: string - name: output_format in: query description: Output format. required: true schema: type: string enum: - JSON - TERRAFORM - CF - name: lookback_duration_days in: query description: Amount of days to look back for used actions required: true schema: type: integer format: int32 example: 90 responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/CustomLeastPrivilegedAccessResponseDto' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/ApiErrorResponseDto' '429': description: Throttled headers: X-RateLimit-Remaining: style: simple schema: type: integer X-RateLimit-Requested-Tokens: style: simple schema: type: integer X-RateLimit-Burst-Capacity: style: simple schema: type: integer X-RateLimit-Replenish-Rate: style: simple schema: type: integer x-microservice: 'true' x-public: 'true' security: - x-redlock-auth: [] servers: - url: https://api.prismacloud.io - url: https://api2.prismacloud.io - url: https://api3.prismacloud.io - url: https://api4.prismacloud.io - url: https://api.anz.prismacloud.io - url: https://api.eu.prismacloud.io - url: https://api2.eu.prismacloud.io - url: https://api.gov.prismacloud.io - url: https://api.prismacloud.cn - url: https://api.ca.prismacloud.io - url: https://api.sg.prismacloud.io - url: https://api.uk.prismacloud.io - url: https://api.ind.prismacloud.io - url: https://api.jp.prismacloud.io - url: https://api.fr.prismacloud.io components: schemas: RemediationRequestDto: description: Model for Remediation Request DTO required: - alerts type: object properties: alerts: type: array description: List of relevant alerts example: - I-1234 - I-1235 items: type: string SuggestResponseDto: description: Model for Suggest Response DTO type: object properties: needsOffsetUpdate: type: boolean description: Should add offset from the query beginning readOnly: true example: true offset: type: integer description: The number of characters of offset from the query beginning format: int32 readOnly: true example: 43 suggestions: uniqueItems: true type: array description: Suggestion list readOnly: true example: - AND items: type: string translate: type: boolean description: Should translate readOnly: true example: false valid: type: boolean description: Is query valid readOnly: true example: true PermissionDto: description: Model for Permission DTO type: object properties: accessedResourcesCount: type: integer description: Accessed resource count format: int64 destCloudAccount: type: string description: Destination cloud account example: '123456789' destCloudRegion: type: string description: Destination cloud region example: AWS London destCloudResourceRrn: type: string description: Destination cloud resource RRN example: rrn::other:eu-west-2:123456789012::my-function destCloudServiceName: type: string description: Destination cloud service name example: iam destCloudType: type: string description: Destination cloud type example: AWS destResourceId: type: string description: Destination cloud resource id example: arn:aws:iam::111111:user/john destResourceName: type: string description: Destination cloud resource name example: john destResourceType: type: string description: Destination cloud resource type example: user effectiveActionName: type: string description: Effective action name exceptions: type: array description: Permission exception list items: $ref: '#/components/schemas/PermissionExceptionDto' grantedByCloudEntityId: type: string description: Granted by cloud entity id example: arn:aws:iam:::role/my-role grantedByCloudEntityName: type: string description: Granted by cloud entity name example: my-role grantedByCloudEntityRrn: type: string description: Granted by cloud entity rrn example: rrn::other::123456789:AIDAIDAIDAIDAIDAIDAID grantedByCloudEntityType: type: string description: Granted by cloud entity type example: user grantedByCloudPolicyId: type: string description: Granted by cloud policy Id example: arn:aws:iam::aws:policy/aws-policy grantedByCloudPolicyName: type: string description: Granted by cloud policy name example: my-policy grantedByCloudPolicyRrn: type: string description: Granted by cloud policy rrn example: rrn::iamPolicy::123456789012::arn:aws:iam:eu-west-2 grantedByCloudPolicyType: type: string description: Granted by cloud policy type example: Customer Managed Policy grantedByCloudType: type: string description: Granted by cloud type example: AWS id: type: string description: Message id example: '13' isWildCardDestCloudResourceName: type: boolean description: Is destination cloud resource name a wildcard example: false lastAccessDate: type: string description: Last accessed data sourceCloudAccount: type: string description: Source cloud account example: '123456789' sourceCloudRegion: type: string description: Source cloud region example: AWS London sourceCloudResourceRrn: type: string description: Source cloud resource RRN example: rrn::iamUser::123456789012::AIDAIDAIDAIDAIDAIDAID sourceCloudServiceName: type: string description: Source cloud service name example: iam sourceCloudType: type: string description: Source cloud type example: AWS sourceIdpDomain: type: string description: Source IDP domain sourceIdpEmail: type: string description: Source IDP email sourceIdpGroup: type: string description: Source IDP group sourceIdpRrn: type: string description: Source idp RRN example: rrn::other::idp-account-id::idp-user-id sourceIdpService: type: string description: Source IDP service enum: - AZURE_AD - OKTA - UNKNOWN sourceIdpUsername: type: string description: Source IDP user name sourcePublic: type: boolean description: Is source public example: false sourceResourceId: type: string description: Source cloud resource id example: arn:aws:iam::111111:user/john sourceResourceName: type: string description: Source cloud resource name example: john sourceResourceType: type: string description: Source cloud resource type example: user TimeRangeDto: description: Model for Time Range DTO type: object properties: type: type: string description: Time range type example: to_now value: type: string description: Time range value example: epoch RemediationResponseDto: description: Model for Remediation Response DTO type: object properties: alertIdVsCliScript: type: object additionalProperties: type: string description: List of relevant remediations readOnly: true example: I-1234: cli command1 I-1235: cli command2 cliDescription: type: string description: Cli Description readOnly: true example: The following are CLI commands required for remediation. Successful execution will limit the relevant permissions of the violating resource.} PermissionSearchResponseDto: description: Model for Permission Search Response DTO type: object properties: data: $ref: '#/components/schemas/PermissionSearchResultDataDto' description: type: string description: Search description example: search-description id: type: string description: Request user Id example: '111111' name: type: string description: Search name example: search-name query: type: string description: Query string example: config from iam where ... saved: type: boolean description: Is search saved example: true searchType: type: string description: Search type example: search-type timeRange: $ref: '#/components/schemas/TimeRangeDto' PermissionExceptionDto: description: Model for Permission Exception DTO type: object properties: messageCode: type: string description: Message code example: LIMITED_BY_DENY_STATEMENT PermissionSearchPageRequestDto: description: Model for Permission Search Page Request DTO type: object properties: limit: type: integer format: int32 description: Maximun number of items to return pageToken: type: string description: Page token from the response object of an earlier request to get permissions. SuggestRequestDto: description: Model for Suggest Request DTO required: - query type: object properties: query: type: string description: Query to validate example: config from iam where dest.cloud.type='AWS' PermissionSearchResultDataDto: description: Model for Permission Search Result Data DTO type: object properties: items: type: array description: Requested permissions list items: $ref: '#/components/schemas/PermissionDto' nextPageToken: type: string description: Next page token example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS searchedDestCloudResourceNames: uniqueItems: true type: array description: Searched destination cloud resource names example: [] items: type: string totalRows: type: integer description: Total row count format: int64 example: 1243 PermissionAccessRequestDto: description: Model for Permission Access Request DTO required: - permissionId - query type: object properties: limit: type: integer description: Maximun number of items to return for the given query. Default is 0. format: int32 example: 5 permissionId: type: string description: Permission Id example: '111111' query: type: string description: Query string example: config from iam where ... PermissionAccessResultDataDto: description: Model for Permission Access Result Data DTO type: object properties: items: type: array description: Permissions list readOnly: true items: $ref: '#/components/schemas/PermissionLastAccessDto' nextPageToken: type: string description: Next page token readOnly: true example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS totalRows: type: integer description: Total row count format: int64 readOnly: true example: 1243 PermissionAccessPageRequestDto: description: Model for Permission Access Page Request DTO type: object properties: limit: type: integer description: Maximun number of items to return for the given query. Default is 0. format: int32 example: 5 pageToken: type: string description: 'Page token (default: empty string)' example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS RqlResponseDto: description: Model for RQL Response DTO type: object properties: data: type: array items: type: string query: type: string timeRange: $ref: '#/components/schemas/TimeRangeDto' PermissionAccessResponseDto: description: Model for Permission Access Response DTO type: object properties: data: $ref: '#/components/schemas/PermissionAccessResultDataDto' PermissionLastAccessDto: description: Model for Permission Last Access DTO type: object properties: destCloudResourceName: type: string description: Destination cloud resource name example: my-function lastAccessDate: type: string description: Action last access date in the format of a unix timestamp example: '1593691785' PermissionSearchRequestDto: description: Model for Permission Search Request DTO required: - limit - query type: object properties: id: type: string description: Request user Id example: '123456' limit: type: integer description: Maximun number of items to return for the given query format: int32 example: 5 query: type: string description: IAM RQL query example: config from iam where ... TimeRangeDto_2: required: - type type: object properties: type: type: string description: The time range which the query run at to generate the alert example: '{''''type'': ''relative'', ''value'': {''unit'': ''day'', ''amount'': 7} }' discriminator: propertyName: type PermissionAccessRequestDtoV3: required: - query type: object properties: query: type: string description: Query string example: config from iam where source.cloud.type = 'AWS' nextPageToken: type: string description: Page Token example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS PermissionRawDataResponseDto: type: object properties: raw: type: string description: raw iam config (rolw/policy) which the permission was calculated from PermissionAccessResponseDtoV3: type: object properties: data: $ref: '#/components/schemas/PermissionAccessResultDataDtoV3' PermissionAccessResultDataDtoV3: type: object properties: items: type: array description: items list items: $ref: '#/components/schemas/PermissionLastAccessDto_2' nextPageToken: type: string description: Next page token example: iam/api/{apiVersion}/{apiPath}?page-token=Q74589g444gg totalRows: type: integer description: Total rows count format: int64 example: 1243 description: Permissions last access list readOnly: true ExistingLeastPrivilegedAccessResponseDto: type: object properties: nextPageToken: type: string description: Next page token example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS permissionsInAssetCount: type: integer description: Number of actions in asset format: int32 example: 10 permissionsInLeastPrivilegedCount: type: integer description: Number of actions in least privileged access format: int32 example: 10 analysis: type: array description: Least Privileged result analysis items: $ref: '#/components/schemas/LeastPrivilegedPermissionVerdict' value: type: array description: Least Privileged Access items items: $ref: '#/components/schemas/ExistingLeastPrivilegedAccessDto' CloudAssetRelatedAssetsRequestDto: type: object properties: relationshipType: type: string description: Relationship Type example: aws_policy_role enum: - AWS_ROLE_POLICY - AWS_ROLE_TRUSTED - AWS_GROUP_USER - AWS_GROUP_POLICY - AWS_POLICY_GROUP - AWS_POLICY_ROLE - AWS_POLICY_RESOURCE - AWS_EC2_ROLE - AZURE_USERASSIGNED_SERVICEAPP - AZURE_USERASSIGNED_ROLEDEFINITION - AZURE_ROLEDEFINITION_USERASSIGNED - AZURE_ROLEDEFINITION_USER - AZURE_GROUP_MEMBERS - AZURE_GROUP_ROLEDEFINITION - AZURE_ROLEDEFINITION_GROUP - AZURE_SERVICEPRINCIPAL_APPREGISTRATION - AZURE_SERVICEPRINCIPAL_ROLEDEFINITION - AZURE_ROLEDEFINITION_SERVICEPRINCIPAL lastAccessFromTime: type: integer description: Last accessed From epoch (epoch) format: int64 example: 1678785157 lastAccessToTime: type: integer description: Last accessed To epoch (epoch) format: int64 example: 1678785157 nextPageToken: type: string description: Page Token example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS PermissionSearchV4RequestDto: required: - query type: object properties: query: type: string description: RQL query example: config from iam where dest.cloud.type='AWS' searchId: type: string description: Saved search id example: ff4fcb80-03f6-41dd-8bd8-6179fd46b3a4 nextPageToken: type: string description: Page Token example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS groupByFields: uniqueItems: true type: array description: Fields to group results by. Empty or missing array is considered the same as an array with all possible fields example: - source - sourceCloudAccount - grantedByEntity - entityCloudAccount - grantedByPolicy - policyCloudAccount - grantedByLevel - action - destination - destCloudAccount - lastAccess items: type: string description: Fields to group results by. Empty or missing array is considered the same as an array with all possible fields example: '["source","sourceCloudAccount","grantedByEntity","entityCloudAccount","grantedByPolicy","policyCloudAccount","grantedByLevel","action","destination","destCloudAccount","lastAccess"]' enum: - source - sourceCloudAccount - grantedByEntity - entityCloudAccount - grantedByPolicy - policyCloudAccount - grantedByLevel - action - destination - destCloudAccount - lastAccess RemediationResponseDtoV2: type: object properties: cliCommand: type: string description: Relevant cli command for remediation example: cli command cliDescription: type: string description: Cli Description example: The following are CLI command is required for remediation. Successful execution will limit the relevant permissions of the violating resource. ExistingLeastPrivilegedAccessDto: type: object properties: iamResourceName: type: string description: The name of the iam resource example: MyIamResource iamResourceId: type: string description: The id of the iam resource example: rrn:aws:iamRole::123456789012:3fab987adf7c268519219cdfe5a4c4c2d4dc:AROAXHNDH53GWC2HSVKSR iamResourceType: type: string description: The type of iam resource example: AWS_POLICY formatType: type: string description: Format type of the access policy example: TERRAFORM snippet: type: string description: The access policy example: A Terraform code for creating a policy description: Least Privileged Access items PermissionSearchV4ResponseDto: type: object properties: data: $ref: '#/components/schemas/PermissionSearchV4ResponseDataDto' query: type: string description: Query string example: config from iam where ... id: type: string description: Request user Id example: '111111' saved: type: boolean description: Is search saved example: true name: type: string description: Search name example: search-name timeRange: $ref: '#/components/schemas/TimeRangeDto_2' searchType: type: string description: Search type example: search-type description: type: string description: Search description example: search-description cloudType: type: string description: Cloud Type example: aws PermissionLastAccessDto_2: type: object properties: destCloudResourceName: type: string description: Destination cloud resource name example: my-function lastAccessDate: type: string description: Action last access date in the format of a unix timestamp example: '1593691785' destCloudRegion: type: string description: Action last access region example: AWS Virginia destCloudAccount: type: string description: Action last access account name example: account_name description: items list SuggestResponseDto_2: type: object properties: valid: type: boolean description: Is query valid readOnly: true example: true suggestions: uniqueItems: true type: array description: Suggestion list readOnly: true example: - AND items: type: string description: Suggestion list readOnly: true example: '["AND"]' translate: type: boolean description: Should translate readOnly: true example: false needsOffsetUpdate: type: boolean description: Should add offset from the query beginning readOnly: true example: true offset: type: integer description: The number of characters of offset from the query beginning format: int32 readOnly: true example: 43 PermissionDto_2: type: object properties: id: type: string description: Message id example: '13' sourcePublic: type: boolean description: Is source public example: false sourceCloudType: type: string description: Source cloud type example: AWS sourceCloudAccount: type: string description: Source cloud account example: '123456789' sourceCloudRegion: type: string description: Source cloud region example: AWS London sourceCloudServiceName: type: string description: Source cloud service name example: iam sourceResourceName: type: string description: Source cloud resource name example: john sourceResourceType: type: string description: Source cloud resource type example: user sourceResourceId: type: string description: Source cloud resource id example: arn:aws:iam::111111:user/john sourceIdpService: type: string description: Source IDP service sourceIdpDomain: type: string description: Source IDP domain sourceIdpEmail: type: string description: Source IDP email sourceIdpUsername: type: string description: Source IDP user name sourceIdpGroup: type: string description: Source IDP group sourceIdpRrn: type: string description: Source idp RRN example: rrn::other::idp-account-id::idp-user-id sourceIdpUai: type: string description: Source idp UAI example: 681390424b288d835f5cd03e7bfb0993 sourceCloudResourceRrn: type: string description: Source cloud resource RRN example: rrn::iamUser::123456789012::AIDAIDAIDAIDAIDAIDAID sourceCloudResourceUai: type: string description: Source cloud resource UAI example: 681390624b288d835f4cd03e7bfb0994 destCloudType: type: string description: Destination cloud type example: AWS destCloudAccount: type: string description: Destination cloud account example: '123456789' destCloudRegion: type: string description: Destination cloud region example: AWS London destCloudServiceName: type: string description: Destination cloud service name example: iam destResourceName: type: string description: Destination cloud resource name example: john destResourceType: type: string description: Destination cloud resource type example: user destResourceId: type: string description: Destination cloud resource id example: arn:aws:iam::111111:user/john destCloudResourceRrn: type: string description: Destination cloud resource RRN example: rrn::other:eu-west-2:123456789012::my-function destCloudResourceUai: type: string description: Destination cloud resource UAI example: 181390424b298d835f4cd03e7bfb0991 effectiveActionName: type: string description: Effective action name grantedByCloudType: type: string description: Granted by cloud type example: AWS grantedByCloudPolicyId: type: string description: Granted by cloud policy Id example: arn:aws:iam::aws:policy/aws-policy grantedByCloudPolicyName: type: string description: Granted by cloud policy name example: my-policy grantedByCloudPolicyType: type: string description: Granted by cloud policy type example: Customer Managed Policy grantedByCloudPolicyRrn: type: string description: Granted by cloud policy rrn example: rrn::iamPolicy::123456789012::arn:aws:iam:eu-west-2 grantedByCloudPolicyUai: type: string description: Granted by cloud policy UAI example: 771390424b298d835f4cd03e7bfb0232 grantedByCloudEntityId: type: string description: Granted by cloud entity id example: arn:aws:iam:::role/my-role grantedByCloudEntityName: type: string description: Granted by cloud entity name example: my-role grantedByCloudEntityType: type: string description: Granted by cloud entity type example: user accessedResourcesCount: type: integer description: Accessed resource count format: int64 lastAccessDate: type: string description: Last accessed data lastAccessStatus: type: string description: Last accessed status grantedByCloudEntityRrn: type: string description: Granted by cloud entity rrn example: rrn::other::123456789:AIDAIDAIDAIDAIDAIDAID grantedByCloudEntityUai: type: string description: Granted by cloud entity UAI example: 223390424b298d835f4cd03e7bfb0111 isWildCardDestCloudResourceName: type: boolean description: Is destination cloud resource name a wildcard example: false exceptions: type: array description: Permission exception list items: $ref: '#/components/schemas/PermissionExceptionDto_2' grantedByLevelType: type: string description: Granted by level type example: GCP Folder grantedByLevelId: type: string description: Granted by level id example: level_id grantedByLevelName: type: string description: Granted by level name example: level_name grantedByLevelRrn: type: string description: Granted by level rrn example: level_rrn grantedByLevelUai: type: string description: Granted by level UAI example: 123390424cb99d835f4cd03e7bfb0991 description: items list PermissionExceptionDto_2: type: object properties: messageCode: type: string description: Message code example: LIMITED_BY_DENY_STATEMENT description: Permission exception list example: - messageCode: LIMITED_BY_DENY_STATEMENT PermissionV4DataItemDto: type: object properties: id: type: string description: Message id example: '13' sourcePublic: type: boolean description: Is source public example: false sourceCloudType: type: string description: Source cloud type example: AWS sourceCloudAccount: type: string description: Source cloud account example: '123456789' sourceCloudRegion: type: string description: Source cloud region example: AWS London sourceCloudServiceName: type: string description: Source cloud service name example: iam sourceResourceName: type: string description: Source cloud resource name example: john sourceResourceType: type: string description: Source cloud resource type example: user sourceResourceId: type: string description: Source cloud resource id example: arn:aws:iam::111111:user/john sourceCloudResourceUai: type: string description: Source cloud resource UAI example: 681390624b288d835f4cd03e7bfb0994 sourceIdpService: type: string description: Source IDP service example: AWS Identity Center sourceIdpDomain: type: string description: Source IDP domain example: idp.com sourceIdpEmail: type: string description: Source IDP email example: idp@email.com sourceIdpUserId: type: string description: Source IDP user id example: '123456789' sourceIdpUsername: type: string description: Source IDP user name example: idp-user sourceIdpGroup: type: string description: Source IDP group example: IdpGroup sourceIdpUai: type: string description: Source idp UAI example: 681390424b288d835f5cd03e7bfb0993 destCloudType: type: string description: Destination cloud type example: AWS destCloudAccount: type: string description: Destination cloud account example: '123456789' destCloudRegion: type: string description: Destination cloud region example: AWS London destCloudServiceName: type: string description: Destination cloud service name example: iam destResourceName: type: string description: Destination cloud resource name example: john destResourceType: type: string description: Destination cloud resource type example: user destResourceId: type: string description: Destination cloud resource id example: arn:aws:iam::111111:user/john destCloudResourceUai: type: string description: Destination cloud resource UAI example: 181390424b298d835f4cd03e7bfb0991 grantedByCloudType: type: string description: Granted by cloud type example: AWS grantedByCloudPolicyId: type: string description: Granted by cloud policy Id example: arn:aws:iam::aws:policy/aws-policy grantedByCloudPolicyName: type: string description: Granted by cloud policy name example: my-policy grantedByCloudPolicyType: type: string description: Granted by cloud policy type example: Customer Managed Policy grantedByCloudPolicyUai: type: string description: Granted by cloud policy UAI example: 771390424b298d835f4cd03e7bfb0232 grantedByCloudPolicyAccount: type: string description: Granted by cloud policy account example: '123456789' grantedByCloudEntityId: type: string description: Granted by cloud entity id example: arn:aws:iam:::role/my-role grantedByCloudEntityName: type: string description: Granted by cloud entity name example: my-role grantedByCloudEntityType: type: string description: Granted by cloud entity type example: user grantedByCloudEntityAccount: type: string description: Granted by cloud entity account example: '123456789' grantedByCloudEntityUai: type: string description: Granted by cloud entity UAI example: 223390424b298d835f4cd03e7bfb0111 grantedByLevelType: type: string description: Granted by level type example: GCP Folder grantedByLevelId: type: string description: Granted by level id example: level_id grantedByLevelName: type: string description: Granted by level name example: level_name grantedByLevelUai: type: string description: Granted by level UAI example: 123390424cb99d835f4cd03e7bfb0991 lastAccessDate: type: string description: Last accessed data example: '2024-01-02' lastAccessStatus: type: string description: Last accessed status example: ACCESSED enum: - NOT_AVAILABLE - NOT_ACCESSED_IN_TRACKING_PERIOD - ACCESSED accessedResourcesCount: type: integer description: Accessed resource count format: int64 example: 12 effectiveActionName: type: string description: Effective action name example: sso:ListApplications exceptions: type: array description: Permission exception list example: - messageCode: LIMITED_BY_DENY_STATEMENT items: $ref: '#/components/schemas/PermissionExceptionDto_2' wildCardDestCloudResourceName: type: boolean description: items list CustomLeastPrivilegedAccessDto: type: object properties: formatType: type: string description: Format type of the access policy example: TERRAFORM snippet: type: string description: The access policy example: Terraform code for creating a policy description: Least Privileged Access items SuggestRequestDto_2: type: object properties: query: type: string description: Query to validate example: config from iam where dest.cloud.type = 'AWS' CloudAssetRelatedAssetsResponseDto: type: object properties: items: type: array description: items list items: $ref: '#/components/schemas/CloudAssetRelatedAssetDto' nextPageToken: type: string description: Next page token example: iam/api/{apiVersion}/{apiPath}?page-token=Q74589g444gg totalRows: type: integer description: Total rows count format: int64 example: 1243 CustomLeastPrivilegedAccessResponseDto: type: object properties: nextPageToken: type: string description: Next page token example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS permissionsInAssetCount: type: integer description: Number of actions in asset format: int32 example: 10 permissionsInLeastPrivilegedCount: type: integer description: Number of actions in least privileged access format: int32 example: 10 analysis: type: array description: Least Privileged result analysis items: $ref: '#/components/schemas/LeastPrivilegedPermissionVerdict' value: type: array description: Least Privileged Access items items: $ref: '#/components/schemas/CustomLeastPrivilegedAccessDto' PermissionSearchResponseDtoV3: type: object properties: data: $ref: '#/components/schemas/PermissionSearchResultDataDtoV3' query: type: string description: Query string example: config from iam where ... id: type: string description: Request user Id example: '111111' saved: type: boolean description: Is search saved example: true name: type: string description: Search name example: search-name timeRange: $ref: '#/components/schemas/TimeRangeDto_2' searchType: type: string description: Search type example: search-type description: type: string description: Search description example: search-description cloudType: type: string description: Cloud Type example: aws OverPermissiveMetadataResponseDto: type: object properties: totalIamResourceCount: type: integer description: The total number of iam resources attached to the asset format: int32 example: 15 overPermissiveCount: type: integer description: The number of over permissive iam resources attached to the asset format: int32 example: 10 isCustomLeastPrivilegedSupported: type: boolean description: Is custom least privileged access supported for asset example: true isExistingLeastPrivilegedSupported: type: boolean description: Is existing least privileged access supported for asset example: true iamResourceType: type: string description: The type of resources attached to the asset example: AWS IAM Policy RqlResponseDtoV2: type: object properties: timeRange: $ref: '#/components/schemas/TimeRangeDto_2' query: type: string example: config from iam where source.cloud.type = 'AWS' PermissionRawDataRequestDto: type: object properties: permissionId: type: string description: PermissionId to get the raw config for. Can be obtain form calling search/permission API example: 06c3cb4403ac276ff59679139b8e6afca2afe93100c8b39014f033ca0339ff0f PermissionSearchResultDataDtoV3: type: object properties: items: type: array description: items list items: $ref: '#/components/schemas/PermissionDto_2' nextPageToken: type: string description: Next page token example: iam/api/{apiVersion}/{apiPath}?page-token=Q74589g444gg totalRows: type: integer description: Total rows count format: int64 example: 1243 searchedDestCloudResourceNames: uniqueItems: true type: array description: Searched destination cloud resource names example: [] items: type: string description: Searched destination cloud resource names example: '[]' LeastPrivilegedPermissionVerdict: type: object properties: action: type: string configurationName: type: string keep: type: boolean description: Least Privileged result analysis ApiErrorResponseBodyDto: required: - code - message type: object properties: code: type: string message: type: string target: type: string details: type: array items: type: string innerError: $ref: '#/components/schemas/ApiErrorResponseDto' CloudAssetRelatedAssetDto: type: object properties: targetAssetId: type: string description: Target Asset Id (unifiedAssetId) example: '1593691785' targetCloudResourceId: type: string description: Target Asset Cloud Resource Id example: '1593691785' targetDisplayName: type: string description: Target DisplayName targetResourceType: type: string description: Target resource type lastAccessDate: type: string description: Action last access date in the format of a unix timestamp example: '1593691785' lastAccessStatus: type: string description: Last accessed status grantedByLevelType: type: string description: Granted by level type description: items list ApiErrorResponseDto: type: object properties: error: $ref: '#/components/schemas/ApiErrorResponseBodyDto' PermissionSearchRequestDtoV3: required: - query type: object properties: query: type: string description: RQL query example: config from iam where source.cloud.type = 'AWS' id: type: string description: An optional saved search id. If not provided, a new saved search will be created. example: 445f6ec2-0a47-4d60-a80c-b0c47e5616f1 nextPageToken: type: string description: Page Token example: ++fdfkjsdlfsdfdFDSFDFSDFdfdssfdFDS PermissionSearchV4ResponseDataDto: type: object properties: items: type: array description: items list items: $ref: '#/components/schemas/PermissionV4DataItemDto' nextPageToken: type: string description: Next page token example: iam/api/{apiVersion}/{apiPath}?page-token=Q74589g444gg totalRows: type: integer description: Total rows count format: int64 example: 1243 searchedDestCloudResourceNames: uniqueItems: true type: array description: Searched destination cloud resource names example: [] items: type: string description: Searched destination cloud resource names example: '[]' securitySchemes: x-redlock-auth: description: The x-redlock-auth value is a JSON Web Token (JWT). in: header name: x-redlock-auth type: apiKey x-refined-from: - palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json - palo-alto-cspm-iammicroservice-openapi.json - palo-alto-cspm-iamv2microservice-openapi.json