openapi: 3.2.0
info:
  title: Palo Alto Networks Integrations Pull API
  version: Latest
  contact: {}
  description: 'Operations tagged Integrations Pull across 2 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-integrationspull-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: "With Prisma Cloud service’s multiple out-of-the-box integration options, you can integrate Prisma Cloud into existing \nsecurity workflows and technologies of your organization.\n\nYou can use [Integrations V1](/prisma-cloud/api/cspm/integrations) for most external integrations. Use the following API endpoints, though, for \nintegrations with:\n\n* Okta\n* Qualys\n* Tenable\n\nIn addition to pushing data to these external systems, Prisma Cloud also pulls data.\n         \n## Integration Configuration\nThe model for an integration between Prisma Cloud and an external system includes an **integrationConfig** parameter which \nis a map of key/value pairs. The type of integration defines the content of these key/value pairs.\nSee [Integration Configurations](/prisma-cloud/api/cspm/api-integration-config) for more information about integration API \nrequest body details, including the **integrationConfig** request parameter key/value pairs that apply to your \nspecific integration API.\n"
  name: Integrations Pull
paths:
  /integration/name:
    get:
      description: "Returns the metadata for your integrations filtered by type.  \n\nThis request supports integrations with only the following:\n\n * Okta\n * Qualys\n * Tenable \n"
      operationId: get-all-integrations-metadata
      parameters:
      - description: Integration type
        in: query
        name: type
        required: true
        schema:
          type: string
      - description: Only enabled integration
        in: query
        name: onlyEnabled
        required: false
        schema:
          default: false
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  additionalProperties:
                    type: string
                  type: object
                type: array
          description: successful operation
        '400':
          description: invalid_integration_type / internal_error
      security:
      - x-redlock-auth: []
      summary: List Metadata for All Integrations
      tags:
      - Integrations Pull
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /integration:
    get:
      description: "Returns all your integrations, optionally filtered by type.  \n\nThis request supports integrations with only the following:\n\n * Okta\n * Qualys\n * Tenable \n"
      operationId: get-all-integrations
      parameters:
      - description: Include only Okta, Tenable, and Qualys integrations
        in: query
        name: type
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/IntegrationViewModel'
                type: array
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List All Integrations
      tags:
      - Integrations Pull
    post:
      description: "Adds an integration with the specified external system.  \n\nThis request supports integrations with only the following:\n\n* Okta\n* Qualys\n* Tenable\n\nThe following request body parameters are required:\n\n* **name**\n* **integrationType**\n* **integrationConfig**\n* **enabled**\n\nThe **integrationConfig** field that is a map of key/value pairs. The type of integration \ndefines the content of these key/value pairs. See [Integration Configuration](/prisma-cloud/api/cspm/api-integration-config) for valid \nkey/value pairs for the **integrationConfig** for your specific external integration.\n"
      operationId: save-integration
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/IntegrationModel'
        description: Model for Integration
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_integration_name / missing_integration_type / integration_name_already_exists / internal_error
      security:
      - x-redlock-auth: []
      summary: Add Integration
      tags:
      - Integrations Pull
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /integration/test:
    post:
      description: "Runs a test of the integration for the specified data.   \n\nThis request supports integrations with only the following:\n\n* Okta\n* Qualys\n* Tenable \n\nThe following request body parameters are required:\n\n* **name**\n* **integrationType**\n* **integrationConfig**\n\nThe request body to test an integration between Prisma Cloud and an external system \nincludes an **integrationConfig** field that is a map of key/value pairs. The type of \nintegration defines the content of these key/value pairs. See [Integration Configuration](/prisma-cloud/api/cspm/api-integration-config) \nfor request body details, including the **integrationConfig** for your specific integration test.\n"
      operationId: test-integration
      parameters:
      - description: Integration ID
        in: query
        name: id
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/IntegrationModel'
        description: Model for Integration
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/ValidatorResponse'
          description: successful operation
        '400':
          description: missing_integration_type / invalid_integration_name / missing_integration_config / internal_error
      security:
      - x-redlock-auth: []
      summary: Test Integration
      tags:
      - Integrations Pull
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /integration/{id}:
    get:
      description: "Returns integration details for the specified ID.  \n\nThis request supports integrations with only the following:\n\n* Okta\n* Qualys\n* Tenable\n\nTo get the integration ID, [list the metadata for all integrations](/prisma-cloud/api/cspm/get-all-integrations-metadata).    \n"
      operationId: get-integration-by-id
      parameters:
      - description: Integration ID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/IntegrationModel'
          description: successful operation
        '400':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Integration By ID
      tags:
      - Integrations Pull
    put:
      description: "Updates the specified integration.  \n\nThis request supports integrations with only the following:\n\n* Okta\n* Qualys\n* Tenable \n\nTo get the integration ID, [list the metadata for all integrations](/prisma-cloud/api/cspm/get-all-integrations-metadata).\n\nThe request body for an integration between Prisma Cloud and an external system includes \nan **integrationConfig** field that is a map of key/value pairs. The type of integration \ndefines the content of these key/value pairs. See [Integration Configuration](/prisma-cloud/api/cspm/api-integration-config) for valid \nkey/value pairs for the **integrationConfig** for your specific external integration.\n\nThe fields you can update in an integration are:\n\n* **name**\n* **integrationConfig**, depending on integration type\n* **description**\n* **enabled** \n"
      operationId: update-integration
      parameters:
      - description: Integration ID
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/IntegrationModel'
        description: Model for Integration
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_integration_name / missing_integration_config / integration_name_already_exists / invalid_id / internal_error
      security:
      - x-redlock-auth: []
      summary: Update Integration
      tags:
      - Integrations Pull
    delete:
      description: "Deletes the integration for the specified ID.  \n\nThis request supports integrations with only the following:\n\n* Okta\n* Qualys\n* Tenable\n"
      operationId: delete-integration
      parameters:
      - in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_id / conflict_deleting_integration / missing_integration_config / internal_error
      security:
      - x-redlock-auth: []
      summary: Delete Integration
      tags:
      - Integrations Pull
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
components:
  schemas:
    MessageDetails:
      description: Model for Message Details
      properties:
        i18nKey:
          description: Internationalization key
          readOnly: true
          type: string
        statusCode:
          description: Status code
          format: int32
          readOnly: true
          type: integer
        subject:
          description: Subject
          readOnly: true
          type: string
      type: object
    TargetTagModel:
      description: Model for Target Tag
      properties:
        key:
          description: Resource tag target
          type: string
        values:
          description: List of value(s) for resource tag key
          items:
            type: string
          type: array
      type: object
    AlertRuleNotificationConfigModel:
      description: Model for Alert Rule Notification Config
      properties:
        dayOfMonth:
          description: Day of month
          format: int32
          readOnly: true
          type: integer
        daysOfWeek:
          description: Days of week
          items:
            $ref: '#/components/schemas/WeekDay'
          readOnly: true
          type: array
        detailedReport:
          description: Provide csv detailed report
          type: boolean
        enabled:
          description: Scan enabled
          type: boolean
        frequency:
          enum:
          - as_it_happens
          - daily
          - weekly
          - monthly
          type: string
        frequencyFromRRule:
          description: Frequency from RRule
          readOnly: true
          type: string
        hourOfDay:
          description: Hour of day
          format: int32
          readOnly: true
          type: integer
        id:
          description: Alert rule notification config ID
          type: string
        includeRemediation:
          description: Include remediation in detailed report
          type: boolean
        lastUpdated:
          description: Last Updated
          format: int64
          type: integer
        last_sent_ts:
          description: Time of last notification in milliseconds
          format: int64
          type: integer
        recipients:
          description: '* For email notifications: List of unique email addresses to notify

            * For integrations without notification templates: List of integration ids

            * For integrations with notification templates: List of notification template ids

            '
          items:
            type: string
          type: array
          uniqueItems: true
        rruleSchedule:
          type: string
        templateId:
          description: Template ID
          type: string
        timezone:
          description: 'Java time zone ID (e.g. America/Los_Angeles) '
          readOnly: true
          type: string
        type:
          description: Integration type
          enum:
          - email
          - slack
          - splunk
          - amazon_sqs
          - jira
          - microsoft_teams
          - webhook
          - aws_security_hub
          - google_cscc
          - service_now
          - pager_duty
          - azure_service_bus_queue
          - demisto
          - aws_s3
          - snowflake
          type: string
        withCompression:
          description: Compress detailed report
          type: boolean
      type: object
    ValidatorResponse:
      properties:
        errorMessages:
          items:
            $ref: '#/components/schemas/ResponseStatus1'
          type: array
        statusCode:
          format: int32
          type: integer
        success:
          type: boolean
        tests:
          items:
            $ref: '#/components/schemas/TestInfo'
          type: array
      type: object
    IntegrationStatusDetails:
      description: Model for Integration Status Details
      properties:
        details:
          allOf:
          - $ref: '#/components/schemas/MessageDetails'
          - description: Details
            readOnly: true
        errorType:
          description: Error type
          enum:
          - INVALID_CONFIG
          - TRANSLATION_EXCEPTION
          - INVALID_TEMPLATE_CONFIG
          - HTTP_EXCEPTION
          - OTHERS
          - TEST
          readOnly: true
          type: string
        lastUpdated:
          description: Last updated
          format: int64
          readOnly: true
          type: integer
        message:
          description: Message
          readOnly: true
          type: string
      type: object
    ResponseStatus1:
      properties:
        i18nKey:
          type: string
        severity:
          enum:
          - ERROR
          - WARNING
          - INFO
          type: string
        subject:
          type: string
      type: object
    AlertRulePolicyFilter:
      description: Model for Alert Rule Policy Filter
      properties:
        availablePolicyFilters:
          description: List of available Alert Rule Policy Filters
          items:
            type: string
          type: array
          uniqueItems: true
        cloud.type:
          description: Cloud Type Filter
          items:
            enum:
            - ALL
            - AWS
            - AZURE
            - GCP
            - ALIBABA_CLOUD
            - OCI
            - IBM
            type: string
          type: array
          uniqueItems: true
        policy.complianceStandard:
          description: Compliance Standard Filter
          items:
            type: string
          type: array
          uniqueItems: true
        policy.label:
          description: Policy Label Filter
          items:
            type: string
          type: array
          uniqueItems: true
        policy.severity:
          description: Policy Severity Filter
          items:
            type: string
          type: array
          uniqueItems: true
      type: object
    PolicyScanConfigModel:
      description: Model for Policy Scan Config
      properties:
        alertRuleNotificationConfig:
          description: List of data for notifications to third-party tools
          items:
            $ref: '#/components/schemas/AlertRuleNotificationConfigModel'
          type: array
        allowAutoRemediate:
          description: Allow Auto-Remediation
          type: boolean
        delayNotificationMs:
          description: Delay notifications by the specified milliseconds
          format: int64
          type: integer
        description:
          description: Rule/Scan description
          type: string
        enabled:
          description: Rule/Scan is enabled
          type: boolean
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedOn:
          description: Last modified on this date/time in milliseconds
          format: int64
          readOnly: true
          type: integer
        name:
          description: Rule/Scan name
          type: string
        notifyOnDismissed:
          description: include dismissed alerts in notification
          type: boolean
        notifyOnOpen:
          description: include open alerts in notification
          type: boolean
        notifyOnResolved:
          description: include resolved alerts in notification
          type: boolean
        notifyOnSnoozed:
          description: include snoozed alerts in notification
          type: boolean
        policies:
          description: List of specific policies to scan
          items:
            type: string
          type: array
        policyLabels:
          description: Policy labels
          items:
            type: string
          type: array
        policyScanConfigId:
          description: Policy Scan Config ID
          type: string
        scanAll:
          description: Scan all policies
          type: boolean
        target:
          allOf:
          - $ref: '#/components/schemas/TargetFilterModel'
          - description: TargetFilter model (target accounts)
      required:
      - name
      - target
      type: object
    IntegrationViewModel:
      description: Model for IntegrationViewModel
      properties:
        alertRules:
          description: Alert Rules
          items:
            $ref: '#/components/schemas/PolicyScanConfigModel'
          readOnly: true
          type: array
        createdBy:
          description: Created by
          readOnly: true
          type: string
        createdTs:
          description: Creation timestamp in milliseconds
          format: int64
          readOnly: true
          type: integer
        description:
          description: Integration description
          type: string
        enabled:
          description: true = Enabled
          type: boolean
        id:
          description: Integration ID
          readOnly: true
          type: string
        integrationConfig:
          additionalProperties:
            type: object
          description: Integration Configuration. The values depend on the integration type.
          type: object
        integrationType:
          description: Integration type
          enum:
          - EMAIL
          - SLACK
          - SPLUNK
          - AMAZON_SQS
          - WEBHOOK
          - MICROSOFT_TEAMS
          - AZURE_SERVICE_BUS_QUEUE
          - JIRA
          - SERVICE_NOW
          - PAGER_DUTY
          - DEMISTO
          - AWS_S3
          - SNOWFLAKE
          - TENABLE
          - QUALYS
          - AZURE_SECURITY_CENTER
          - GOOGLE_CSCC
          - AWS_SECURITY_HUB
          - OKTA_IDP
          type: string
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Last modification timestamp in milliseconds
          format: int64
          readOnly: true
          type: integer
        name:
          description: Integration name
          type: string
        reason:
          allOf:
          - $ref: '#/components/schemas/IntegrationStatusDetails'
          - description: Reason for marking the integration faulty
            readOnly: true
        status:
          description: State of integration
          enum:
          - GREEN
          - RED
          - YELLOW
          - NA
          readOnly: true
          type: string
        valid:
          description: true = Is valid
          readOnly: true
          type: boolean
      type: object
    WeekDay:
      properties:
        day:
          enum:
          - SU
          - MO
          - TU
          - WE
          - TH
          - FR
          - SA
          type: string
        offset:
          format: int32
          type: integer
      type: object
    ResourceListIdsCollection:
      description: Model for holding the lists resource list ids by resource list type
      properties:
        computeAccessGroupIds:
          items:
            type: string
          type: array
      type: object
    TargetFilterModel:
      description: Model for Target Filter
      properties:
        accountGroups:
          description: List of Account group(s)
          items:
            type: string
          type: array
        alertRulePolicyFilter:
          allOf:
          - $ref: '#/components/schemas/AlertRulePolicyFilter'
          - description: Policy Filters for the Alert Rule
        excludedAccounts:
          description: List of excluded accounts
          items:
            type: string
          type: array
        includedResourceLists:
          allOf:
          - $ref: '#/components/schemas/ResourceListIdsCollection'
          - description: List of resource lists included which the resource has to match on.
        regions:
          description: List of regions for which alerts will be triggered for account groups. Alerts not associated with specific regions will be triggered regardless of listed regions. If no regions are specified, then the alerts will be triggered for all regions.
          items:
            type: string
          type: array
        tags:
          description: List of TargetTag models (resource tags) for which alerts should be triggered
          items:
            $ref: '#/components/schemas/TargetTagModel'
          type: array
      type: object
    TestInfo:
      properties:
        description:
          type: string
        errorMessage:
          type: string
        key:
          type: string
        success:
          type: boolean
      type: object
    IntegrationModel:
      description: Model for Integration
      properties:
        createdBy:
          description: Created by
          readOnly: true
          type: string
        createdTs:
          description: Creation timestamp in milliseconds
          format: int64
          readOnly: true
          type: integer
        description:
          description: Integration description
          type: string
        enabled:
          description: true = Enabled
          type: boolean
        id:
          description: Integration ID
          readOnly: true
          type: string
        integrationConfig:
          additionalProperties:
            type: object
          description: Integration Configuration. The values depend on the integration type.
          type: object
        integrationType:
          description: Integration type
          enum:
          - EMAIL
          - SLACK
          - SPLUNK
          - AMAZON_SQS
          - WEBHOOK
          - MICROSOFT_TEAMS
          - AZURE_SERVICE_BUS_QUEUE
          - JIRA
          - SERVICE_NOW
          - PAGER_DUTY
          - DEMISTO
          - AWS_S3
          - SNOWFLAKE
          - TENABLE
          - QUALYS
          - AZURE_SECURITY_CENTER
          - GOOGLE_CSCC
          - AWS_SECURITY_HUB
          - OKTA_IDP
          type: string
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Last modification timestamp in milliseconds
          format: int64
          readOnly: true
          type: integer
        name:
          description: Integration name
          type: string
        reason:
          allOf:
          - $ref: '#/components/schemas/IntegrationStatusDetails'
          - description: Reason for marking the integration faulty
            readOnly: true
        status:
          description: State of integration
          enum:
          - GREEN
          - RED
          - YELLOW
          - NA
          readOnly: true
          type: string
        valid:
          description: true = Is valid
          readOnly: true
          type: boolean
      type: object
    ValidatorResponse_2:
      properties:
        errorMessages:
          items:
            $ref: '#/components/schemas/ResponseStatus'
          type: array
        statusCode:
          format: int32
          type: integer
        success:
          type: boolean
        tests:
          items:
            $ref: '#/components/schemas/TestInfo'
          type: array
      type: object
    IntegrationViewModel_2:
      description: Model for IntegrationViewModel
      properties:
        alertRules:
          description: Alert Rules
          items:
            $ref: '#/components/schemas/PolicyScanConfigModel'
          readOnly: true
          type: array
        createdBy:
          description: Created by
          readOnly: true
          type: string
        createdTs:
          description: Creation timestamp in milliseconds
          format: int64
          readOnly: true
          type: integer
        description:
          description: Integration description
          type: string
        enabled:
          description: true = Enabled
          type: boolean
        id:
          description: Integration ID
          readOnly: true
          type: string
        integrationConfig:
          additionalProperties:
            type: object
          description: Integration Configuration. The values depend on the integration type.
          type: object
        integrationType:
          description: Integration type
          enum:
          - EMAIL
          - SLACK
          - SPLUNK
          - AMAZON_SQS
          - WEBHOOK
          - MICROSOFT_TEAMS
          - AZURE_SERVICE_BUS_QUEUE
          - JIRA
          - SERVICE_NOW
          - PAGER_DUTY
          - DEMISTO
          - AWS_S3
          - SNOWFLAKE
          - TENABLE
          - QUALYS
          - AZURE_SECURITY_CENTER
          - GOOGLE_CSCC
          - AWS_SECURITY_HUB
          - AWS_SDL
          - OKTA_IDP
          type: string
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Last modification timestamp in milliseconds
          format: int64
          readOnly: true
          type: integer
        name:
          description: Integration name
          type: string
        reason:
          allOf:
          - $ref: '#/components/schemas/IntegrationStatusDetails'
          - description: Reason for marking the integration faulty
            readOnly: true
        status:
          description: State of integration
          enum:
          - GREEN
          - RED
          - YELLOW
          - NA
          readOnly: true
          type: string
        valid:
          description: true = Is valid
          readOnly: true
          type: boolean
      type: object
    ResponseStatus:
      properties:
        i18nKey:
          type: string
        severity:
          enum:
          - ERROR
          - WARNING
          - INFO
          type: string
        subject:
          type: string
      type: object
    IntegrationModel_2:
      description: Model for Integration
      properties:
        createdBy:
          description: Created by
          readOnly: true
          type: string
        createdTs:
          description: Creation timestamp in milliseconds
          format: int64
          readOnly: true
          type: integer
        description:
          description: Integration description
          type: string
        enabled:
          description: true = Enabled
          type: boolean
        id:
          description: Integration ID
          readOnly: true
          type: string
        integrationConfig:
          additionalProperties:
            type: object
          description: Integration Configuration. The values depend on the integration type.
          type: object
        integrationType:
          description: Integration type
          enum:
          - EMAIL
          - SLACK
          - SPLUNK
          - AMAZON_SQS
          - WEBHOOK
          - MICROSOFT_TEAMS
          - AZURE_SERVICE_BUS_QUEUE
          - JIRA
          - SERVICE_NOW
          - PAGER_DUTY
          - DEMISTO
          - AWS_S3
          - AWS_SDL
          - SNOWFLAKE
          - TENABLE
          - QUALYS
          - AZURE_SECURITY_CENTER
          - GOOGLE_CSCC
          - AWS_SECURITY_HUB
          - OKTA_IDP
          type: string
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Last modification timestamp in milliseconds
          format: int64
          readOnly: true
          type: integer
        name:
          description: Integration name
          type: string
        reason:
          allOf:
          - $ref: '#/components/schemas/IntegrationStatusDetails'
          - description: Reason for marking the integration faulty
            readOnly: true
        status:
          description: State of integration
          enum:
          - GREEN
          - RED
          - YELLOW
          - NA
          readOnly: true
          type: string
        valid:
          description: true = Is valid
          readOnly: true
          type: boolean
      type: object
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
x-refined-from:
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json
- palo-alto-cspm-integrationspull-openapi.json