openapi: 3.2.0
info:
  contact: {}
  description: 'Access Keys are a secure way to enable programmatic access to the Prisma Cloud API. By default, only

    the System Admin has API access and can enable API access for other administrators. If you have API access,

    you can create up to two access keys. Create an access key for a limited time period and regenerate your API

    keys periodically to minimize exposure and follow security best practices.'
  title: Prisma Cloud Access Keys API Overview IP Allow List API
  version: Latest
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
tags:
- description: Manage a list of trusted IP addresses with respect to alerts and a list of trusted login IP addresses.
  name: IP Allowlist
paths:
  /allow_list/network:
    get:
      description: Returns an array of public networks.
      operationId: get-networks-list
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/PublicNetwork'
                type: array
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List Networks
      tags:
      - IP Allowlist
    post:
      description: 'Adds a public network.


        The resulting new network does not have any CIDR blocks, so none will be in the response object. You can add a CIDR to the network with Add CIDR'
      operationId: add-a-network
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/PublicNetwork'
        description: Model for Public Network
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/PublicNetwork'
          description: successful operation
        '400':
          description: invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: Add Network
      tags:
      - IP Allowlist
  /allow_list/network/{networkUuid}:
    get:
      description: Returns the public network with the specified network ID.
      operationId: get-network-info
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/PublicNetwork'
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: no_results
      security:
      - x-redlock-auth: []
      summary: Network Info
      tags:
      - IP Allowlist
    put:
      description: Renames an existing network.
      operationId: rename-a-network
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/PublicNetwork'
        description: Model for Public Network
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: no_results
      security:
      - x-redlock-auth: []
      summary: Rename Network
      tags:
      - IP Allowlist
  /allow_list/network/{networkUuid}/cidr:
    post:
      description: Adds a new CIDR block. The CIDR block cannot overlap CIDR blocks that already exist in the networks you manage. Also, IP addresses in the CIDR block must be routable to the public internet.
      operationId: add-cidr-block
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/PublicNetworkCidrBlock'
        description: Model for Public Network CIDR Block
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/PublicNetworkCidrBlock'
          description: successful operation
        '400':
          description: invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: Add CIDR
      tags:
      - IP Allowlist
  /allow_list/network/{networkUuid}/cidr/{cidrUuid}:
    put:
      description: 'Updates an existing CIDR block.


        Note that the value for the request body parameter **description** will update the description for the CIDR block, even if the **description**

        value is blank. Providing a blank description will remove an existing CIDR block description.'
      operationId: update-cidr-block
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      - description: CIDR ID
        in: path
        name: cidrUuid
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/PublicNetworkCidrBlock'
        description: Model for Public Network CIDR Block
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: no_results
      security:
      - x-redlock-auth: []
      summary: Update CIDR
      tags:
      - IP Allowlist
    delete:
      description: Deletes an existing CIDR block.
      operationId: delete-cidr-block
      parameters:
      - description: Network ID
        in: path
        name: networkUuid
        required: true
        schema:
          type: string
      - description: CIDR ID
        in: path
        name: cidrUuid
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_parameter_value
        '404':
          description: no_results
      security:
      - x-redlock-auth: []
      summary: Delete CIDR
      tags:
      - IP Allowlist
  /ip_allow_list_login:
    get:
      description: Returns a list of data objects that contain the CIDRs in the allow list to access the Prisma Cloud tenant.
      operationId: list-login-ip-allow-lists
      responses:
        '200':
          content:
            '*/*':
              schema:
                items:
                  $ref: '#/components/schemas/LoginIpAllowListData'
                type: array
          description: successful operation
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Login IP Allow Lists
      tags:
      - IP Allowlist
    post:
      description: Adds a named list of CIDRs (IP addresses) that are in the allow list to access Prisma Cloud. You can add up to 10 CIDRs per named list, and there can be up to 50 named lists.
      operationId: insert-login-ip-allow-list
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IpAllowListParams'
        description: Model for login IP allow list parameters
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/LoginIpAllowListData'
          description: successful operation
        '400':
          description: login_ip_allow_list_invalid_cidr_format / login_ip_allow_list_missing_cidr_field / login_ip_allow_list_size_exceeded / login_ip_allow_list_cidr_list_size_exceeded
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '409':
          description: login_ip_allow_list_duplicate_key
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Add Login IP Allow List
      tags:
      - IP Allowlist
  /ip_allow_list_login/{id}:
    get:
      description: Returns a data object that contains a list of CIDRs that are in allow list for login access, for the specified login IP allow list ID.
      operationId: get-login-ip-allow-list
      parameters:
      - description: Login IP Allow List ID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/LoginIpAllowListData'
          description: successful operation
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Login IP Allow List
      tags:
      - IP Allowlist
    put:
      description: Updates a named list of CIDRs (IP addresses) that are in the allow list for login access.
      operationId: update-login-ip-allow-list
      parameters:
      - description: ID of named network
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IpAllowListParams'
        description: Model for login IP allow list parameters
        required: true
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/LoginIpAllowListData'
          description: successful operation
        '400':
          description: login_ip_allow_list_invalid_cidr_format / login_ip_allow_list_missing_cidr_field / login_ip_allow_list_enable_not_allowed_ip_absent / login_ip_allow_list_not_allowed_ip_present
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '409':
          description: login_ip_allow_list_duplicate_name
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Update Login IP Allow List
      tags:
      - IP Allowlist
    delete:
      description: Deletes a named list of CIDRs that are in the allow list for login access. If only one allow list entry exists, you will not be able to delete it while the login IP allow list is enabled.
      operationId: delete-login-ip-allow-list
      parameters:
      - description: ID of named network
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: successful operation
        '400':
          description: login_ip_allow_list_not_allowed_ip_absent / login_ip_allow_list_size_only_one_entry / login_ip_allow_list_not_allowed_ip_present
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Delete Login IP Allow List
      tags:
      - IP Allowlist
  /ip_allow_list_login/status:
    get:
      description: Indicates whether or not the login IP allow list is enabled.
      operationId: get-login-ip-allow-list-status
      responses:
        '200':
          content:
            '*/*':
              schema:
                additionalProperties:
                  type: boolean
                type: object
          description: successful operation
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Login IP Allow List Status
      tags:
      - IP Allowlist
    patch:
      description: Enable or disable the login IP allow list.
      operationId: update-login-ip-allow-list-status
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
        description: 'The property name is **enabled**. Valid values are **true**, **false**. JSON example: {"enabled":false}'
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: login_ip_allow_list_enable_not_allowed_ip_absent / login_ip_allow_list_enable_not_allowed_empty_list
        '403':
          description: login_ip_allow_list_feature_flag_disabled
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Update Login IP Allow List Status
      tags:
      - IP Allowlist
components:
  schemas:
    PublicNetworkCidrBlock:
      properties:
        cidr:
          description: Valid CIDR. CIDR must be of the form [0-255].[0-255].[0-255].[0-255]/[1-32], must not have non-zero bits right of the netmask, and must not overlap any of the RFC 1918 defined private networks.
          type: string
        createdOn:
          description: Created On
          format: int64
          readOnly: true
          type: integer
        description:
          description: Description
          type: string
        uuid:
          description: CIDR ID
          readOnly: true
          type: string
      required:
      - cidr
      type: object
    LoginIpAllowListData:
      description: Model for login IP allow list data
      properties:
        cidr:
          description: List of CIDR blocks (IP addresses) from which access is allowed when Login IP Allow List is enabled.
          items:
            type: string
          type: array
        description:
          description: Description
          type: string
        id:
          description: Login IP allow list ID
          type: string
        lastModifiedTs:
          description: Timestamp for last modification of CIDR block list
          format: int64
          type: integer
        name:
          description: Name of the list of CIDR blocks that are in allow list for access
          type: string
      type: object
    IpAllowListParams:
      description: Model for login IP allow list parameters
      properties:
        cidr:
          description: List of CIDRs to Allow List for login access. You can include from 1 to 10 CIDRs
          items:
            type: string
          type: array
        description:
          description: Description of CIDR (IP addresses) allow list
          type: string
        name:
          description: Unique name for CIDR (IP addresses) allow list
          type: string
      required:
      - cidr
      - name
      type: object
    PublicNetwork:
      properties:
        cidrs:
          description: CIDRs
          items:
            $ref: '#/components/schemas/PublicNetworkCidrBlock'
          readOnly: true
          type: array
        name:
          description: Network Name
          type: string
        uuid:
          description: Network ID
          readOnly: true
          type: string
      required:
      - name
      type: object
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey