openapi: 3.2.0
info:
  title: Palo Alto Networks Permission Groups API
  version: '1.0'
  description: 'Operations tagged Permission Groups across 2 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-permissiongroupsmicroservice-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: Permission groups enable you to restrict access to one or more features available on the Prisma Cloud administrative console. Permission group APIs allow you to retrieve, update or delete one or more existing permissions groups. You can also use these APIs to create a custom permission group and then you must attach it to a role and assign the role to a user.
  name: Permission Groups
paths:
  /authz/v1/feature:
    get:
      tags:
      - Permission Groups
      summary: Get all active features
      description: Returns a list of Prisma Cloud features that can be added to Custom Permission Groups
      operationId: getFeatures
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                type: array
                items:
                  type: string
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /authz/v1/permission_group/{id}:
    get:
      tags:
      - Permission Groups
      summary: Get an existing Permission Group by ID
      description: Queries a list of existing permission groups by ID and returns a specific permission group that matches the Permission Group ID.
      operationId: get_1
      parameters:
      - name: id
        in: path
        description: PermissionGroupID
        required: true
        schema:
          type: string
      - name: includeAssociatedRoles
        in: query
        description: To include associated roles in the response
        required: false
        schema:
          type: boolean
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGroupDetail'
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PermissionGroupDetail'
      security:
      - x-redlock-auth: []
    put:
      tags:
      - Permission Groups
      summary: Update an existing Permission Group
      description: Updates the parameters of an existing permission group.
      operationId: update_1
      parameters:
      - name: id
        in: path
        description: PermissionGroupId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionGroupRequest'
        required: true
      responses:
        '204':
          description: Successful operation
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
      security:
      - x-redlock-auth: []
    delete:
      tags:
      - Permission Groups
      summary: Delete an existing Permission Group by ID
      description: Deletes the default or custom permission group with the specified ID.
      operationId: delete
      parameters:
      - name: id
        in: path
        description: PermissionGroupID
        required: true
        schema:
          type: string
      responses:
        '204':
          description: Successful operation
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /authz/v1/permission_group:
    get:
      tags:
      - Permission Groups
      summary: Get all existing Permission Groups
      description: Returns a list of all existing Permission Groups.
      operationId: getAll
      parameters:
      - name: includeAssociatedRoles
        in: query
        description: To include associated roles in the response
        required: false
        schema:
          type: boolean
      - name: includeFeatures
        in: query
        description: To include permitted features in the response
        required: false
        schema:
          type: boolean
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PermissionGroupDetail'
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/PermissionGroupDetail'
      security:
      - x-redlock-auth: []
    post:
      tags:
      - Permission Groups
      summary: Add new Custom Permission Group
      description: Creates a new custom permission group with granular permissions that restrict access to the Prisma Cloud administrative console. Values include name, optional description and selection of enabled features and functions.
      operationId: save
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PermissionGroupRequest'
        required: true
      responses:
        '201':
          description: Successful operation
        4XX:
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
components:
  schemas:
    PermissionGroupDetail:
      type: object
      properties:
        name:
          type: string
          description: Permission Group Name
        description:
          type: string
          description: Permission Group Description
        type:
          type: string
          description: Permission Group Type
          enum:
          - Default
          - Custom
          - Internal
          - Default
          - Custom
        lastModifiedBy:
          type: string
        lastModifiedTs:
          type: integer
          format: int64
        associatedRoles:
          type: object
          additionalProperties:
            type: object
            description: Map of associated role Ids and Names
          description: Map of associated role Ids and Names
        features:
          $ref: '#/components/schemas/Feature1'
        acceptAccountGroups:
          type: boolean
          description: acceptAccountGroups
        acceptResourceLists:
          type: boolean
          description: acceptResourceLists
        acceptCodeRepositories:
          type: boolean
          description: acceptCodeRepositories
        custom:
          type: boolean
          description: Boolean value signifying whether this is a custom (i.e. user-defined) permission group. Is set to true if the attribute value of permissionGroupType is set to CUSTOM
        id:
          type: string
          description: Permission Group ID
    PermissionGroupRequest:
      title: Model used for permission group
      required:
      - features
      - name
      type: object
      properties:
        name:
          type: string
          description: Permission Group Name
        description:
          type: string
          description: Permission Group Description
        features:
          type: array
          description: List of Prisma Cloud Features
          items:
            $ref: '#/components/schemas/Feature1'
    Feature1:
      required:
      - featureName
      - operations
      type: object
      properties:
        featureName:
          type: string
          description: 'Prisma Cloud Feature Name. Prisma Cloud feature names can be retreived from GET: /authz/v1/feature API Endpoint'
        operations:
          type: object
          additionalProperties:
            type: object
            description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
          description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
      description: "Collection of permitted features associated with the role. \n Refer to PermissionGroup API docs to get the entire list of PC features."
    PermissionGroupDetail_2:
      type: object
      properties:
        name:
          type: string
          description: Permission Group Name
        description:
          type: string
          description: Permission Group Description
        type:
          type: string
          description: Permission Group Type
          enum:
          - Default
          - Custom
        lastModifiedBy:
          type: string
        lastModifiedTs:
          type: integer
          format: int64
        associatedRoles:
          type: object
          additionalProperties:
            type: object
            description: Map of associated role Ids and Names
          description: Map of associated role Ids and Names
        features:
          $ref: '#/components/schemas/Feature'
        acceptAccountGroups:
          type: boolean
          description: acceptAccountGroups
        acceptResourceLists:
          type: boolean
          description: acceptResourceLists
        acceptCodeRepositories:
          type: boolean
          description: acceptCodeRepositories
        custom:
          type: boolean
          description: Boolean value signifying whether this is a custom (i.e. user-defined) permission group. Is set to true if the attribute value of permissionGroupType is set to CUSTOM
        id:
          type: string
          description: Permission Group ID
    PermissionGroupRequest_2:
      title: Model used for permission group
      required:
      - features
      - name
      type: object
      properties:
        name:
          type: string
          description: Permission Group Name
        description:
          type: string
          description: Permission Group Description
        features:
          type: array
          description: List of Prisma Cloud Features
          items:
            $ref: '#/components/schemas/Feature'
    Feature:
      required:
      - featureName
      - operations
      type: object
      properties:
        featureName:
          type: string
          description: 'Prisma Cloud Feature Name. Prisma Cloud feature names can be retreived from GET: /authz/v1/feature API Endpoint'
        operations:
          type: object
          additionalProperties:
            type: object
            description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
          description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
      description: List of Prisma Cloud Features
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
externalDocs:
  description: Platform Wiki Documentation
  url: https://redlock.atlassian.net/wiki/spaces/RED/pages/2744877602/Platform+AuthN+Integration+Template
x-refined-from:
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json
- palo-alto-cspm-permissiongroupsmicroservice-openapi.json