openapi: 3.1.0
info:
  title: Palo Alto Networks AIOps for NGFW BPA 5G Deregistered Trend SaaS Instance API
  description: AIOps for NGFW Best Practice Assessment (BPA) API. Provides programmatic access to submit BPA requests for Palo Alto Networks next-generation firewalls, check request processing status, and retrieve completed assessment reports. BPA reports analyze firewall configurations against Palo Alto Networks best practices and security benchmarks, identifying gaps and providing remediation guidance to improve security posture. Part of the Strata Cloud Manager platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
security:
- oauth2Bearer: []
tags:
- name: SaaS Instance
paths:
  /sspm/identity/v1/saas_instances:
    get:
      summary: Palo Alto Networks Get SaaS Instance List
      description: "Retrieve a list of software as a service (SaaS) instances configured for the tenant. \nEach instance includes metadata such as application type and display name."
      operationId: saas_instances_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseSaaSInstanceInfo'
              examples:
                SaasInstancesGet200Example:
                  summary: Default saas_instances_get 200 response
                  x-microcks-default: true
                  value:
                    total: 345
                    items:
                    - displayName: Production Agent 13
                      saasInstanceId: '806450'
                      appType: custom
        '404':
          description: Not Found
      parameters:
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - SaaS Instance
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts:
    get:
      summary: Palo Alto Networks Get SaaS Account List
      description: "Retrieve a list of user accounts associated with the specified software as a service (SaaS) instance. \nThe response includes account metadata such as roles, login activity, and status for each user."
      operationId: saas_instances_saas_accounts_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseSaaSAccount'
              examples:
                SaasInstancesSaasAccountsGet200Example:
                  summary: Default saas_instances_saas_accounts_get 200 response
                  x-microcks-default: true
                  value:
                    total: 36
                    items:
                    - id: example-id
                      saasProviderId: '593378'
                      tenant: example-tenant
                      saasInstanceId: '357865'
                      jobId: '954046'
                      appId: '116192'
                      appType: standard
                      accountType: custom
                      accountName: Primary Sensor 93
                      email: jsmith@example.com
                      isLocal: true
                      isOrphaned: false
                      isElevated: true
                      ticketKey: example-ticketKey
                      ticketUrl: example-ticketUrl
                      roles: example-roles
                      creator: example-creator
                      linkedHumanAccounts: example-linkedHumanAccounts
                      saasProviderNhiName: Staging Policy 58
                      lastModifiedTime: &id001 2022-03-10 16:15:50+00:00
                      lastLoginTime: *id001
                      isNonHuman: false
                      createdTime: *id001
                      latestScanTime: *id001
                      lastCredentialsRotated: *id001
                      rotatedBy: example-rotatedBy
                      githubOrgName: Corporate Sensor 58
                      credentialsExpiresAt: *id001
                    - id: example-id
                      saasProviderId: '168374'
                      tenant: example-tenant
                      saasInstanceId: '608799'
                      jobId: '926117'
                      appId: '762667'
                      appType: standard
                      accountType: advanced
                      accountName: Staging Agent 78
                      email: jane.doe@example.com
                      isLocal: true
                      isOrphaned: false
                      isElevated: false
                      ticketKey: example-ticketKey
                      ticketUrl: example-ticketUrl
                      roles: example-roles
                      creator: example-creator
                      linkedHumanAccounts: example-linkedHumanAccounts
                      saasProviderNhiName: Branch Sensor 45
                      lastModifiedTime: *id001
                      lastLoginTime: *id001
                      isNonHuman: true
                      createdTime: *id001
                      latestScanTime: *id001
                      lastCredentialsRotated: *id001
                      rotatedBy: example-rotatedBy
                      githubOrgName: Corporate Gateway 50
                      credentialsExpiresAt: *id001
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
        example: '487550'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
        example: 90
      - name: page
        in: query
        schema:
          format: int32
          type: integer
        example: 772
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - SaaS Instance
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/count:
    get:
      summary: Palo Alto Networks Get SaaS Account Count
      description: "Return the number of user accounts associated with the specified software as a service (SaaS) instance. \nYou can apply filters to refine the account count based on criteria such as roles, status, or account types."
      operationId: saas_instances_saas_accounts_count_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  format: int64
                  type: integer
              examples:
                SaasInstancesSaasAccountsCountGet200Example:
                  summary: Default saas_instances_saas_accounts_count_get 200 response
                  x-microcks-default: true
                  value: {}
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
        example: '116090'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - SaaS Instance
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/csv_report:
    post:
      summary: Palo Alto Networks Generate SaaS Account CSV Report
      description: "Generate a CSV report of accounts linked to the specified software as a service (SaaS) instance. \nThis report helps in auditing user presence and roles within the application."
      operationId: saas_instances_saas_accounts_count_csv_report_post
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
        example: '677018'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - SaaS Instance
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DownloadCsvRequest'
            examples:
              SaasInstancesSaasAccountsCountCsvReportPostRequestExample:
                summary: Default saas_instances_saas_accounts_count_csv_report_post request
                x-microcks-default: true
                value:
                  userFullName: soc-analyst
                  userEmail: example-userEmail
                  service: example-service
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_activity:
    get:
      summary: Palo Alto Networks Get SaaS Activity Logs
      description: "Retrieve a list of activity logs for the specified software as a service (SaaS) instance. \nLogs include user actions, accessed resources, locations, and timestamps to support security auditing and monitoring."
      operationId: saas_instances_saas_activity_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseSaaSActivity'
              examples:
                SaasInstancesSaasActivityGet200Example:
                  summary: Default saas_instances_saas_activity_get 200 response
                  x-microcks-default: true
                  value:
                    total: 758
                    items:
                    - id: example-id
                      userId: '561798'
                      tenant: example-tenant
                      saasInstanceId: '246211'
                      appType: custom
                      resourceType: advanced
                      resourceName: Staging Agent 22
                      activityType: standard
                      clientIP: example-clientIP
                      location: example-location
                      userAgent: example-userAgent
                      summary: Configured policy configured configured violation suspicious malware.
                      rawData: example-rawData
                      activityDateTime: &id002 2022-03-10 16:15:50+00:00
                      createdAt: *id002
                    - id: example-id
                      userId: '362728'
                      tenant: example-tenant
                      saasInstanceId: '778286'
                      appType: custom
                      resourceType: advanced
                      resourceName: Primary Gateway 93
                      activityType: advanced
                      clientIP: example-clientIP
                      location: example-location
                      userAgent: example-userAgent
                      summary: Network incident threat rule investigation endpoint.
                      rawData: example-rawData
                      activityDateTime: *id002
                      createdAt: *id002
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
        example: '925818'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
        example: 992
      - name: page
        in: query
        schema:
          format: int32
          type: integer
        example: 998
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - SaaS Instance
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/{saasInstanceId}/tickets:
    get:
      summary: Palo Alto Networks Get SaaS Instance Tickets
      description: Retrieve a list of tickets associated with the specified software as a service (SaaS) instance. Tickets track security findings, misconfigurations, or other remediation needs.
      operationId: saas_instances_tickets_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseTicket'
              examples:
                SaasInstancesTicketsGet200Example:
                  summary: Default saas_instances_tickets_get 200 response
                  x-microcks-default: true
                  value:
                    total: 998
                    items:
                    - id: example-id
                      tenant: example-tenant
                      saasInstanceId: '788637'
                      resourceIds: example-resourceIds
                      feature: example-feature
                      users: example-users
                      integrationId: '917387'
                      type: custom
                      ticketKey: example-ticketKey
                      ticketUrl: example-ticketUrl
                      summary: Configured applied suspicious violation malware traffic endpoint on.
                      createdAt: &id003 2022-03-10 16:15:50+00:00
                    - id: example-id
                      tenant: example-tenant
                      saasInstanceId: '430821'
                      resourceIds: example-resourceIds
                      feature: example-feature
                      users: example-users
                      integrationId: '571142'
                      type: advanced
                      ticketKey: example-ticketKey
                      ticketUrl: example-ticketUrl
                      summary: Applied rule investigation applied firewall incident network network Security blocked.
                      createdAt: *id003
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
        example: '601090'
      - name: filter
        in: query
        schema:
          type: string
        example: example-filter
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
        example: 921
      - name: page
        in: query
        schema:
          format: int32
          type: integer
        example: 549
      - name: sortBy
        in: query
        schema:
          type: string
        example: example-sortBy
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - SaaS Instance
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      summary: Palo Alto Networks Create SaaS Instance Ticket
      description: "Create a new ticket for the specified software as a service (SaaS) instance. \nTickets help track remediation efforts for flagged issues or vulnerabilities."
      operationId: saas_instances_tickets_post
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Ticket'
              examples:
                SaasInstancesTicketsPost200Example:
                  summary: Default saas_instances_tickets_post 200 response
                  x-microcks-default: true
                  value:
                    id: example-id
                    tenant: example-tenant
                    saasInstanceId: '155449'
                    resourceIds: example-resourceIds
                    feature: example-feature
                    users: example-users
                    integrationId: '300696'
                    type: advanced
                    ticketKey: example-ticketKey
                    ticketUrl: example-ticketUrl
                    summary: Suspicious detected traffic alert investigation endpoint firewall traffic monitoring.
                    createdAt: 2022-03-10 16:15:50+00:00
        '400':
          description: Bad Request
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
        example: '685163'
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - SaaS Instance
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTicketRequest'
            examples:
              SaasInstancesTicketsPostRequestExample:
                summary: Default saas_instances_tickets_post request
                x-microcks-default: true
                value:
                  resourceIds:
                  - example-resourceIds_item
                  - example-resourceIds_item
                  feature: ACTIVITY
                  integrationId: '834310'
                  type: advanced
                  issueTypeId: '702842'
                  summary: Threat Security malware network rule threat on network threat policy.
                  description: Configured incident applied traffic endpoint monitoring rule.
                  settings: {}
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    delete:
      summary: Palo Alto Networks Delete SaaS Instance Tickets
      description: "Delete or unlink one or more tickets associated with the specified software as a service (SaaS) instance. \nThis action is typically used to close resolved or invalid issues."
      operationId: saas_instances_tickets_delete
      responses:
        '204':
          description: No Content
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
        example: '869627'
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - SaaS Instance
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UnlinkTicketRequest'
            examples:
              SaasInstancesTicketsDeleteRequestExample:
                summary: Default saas_instances_tickets_delete request
                x-microcks-default: true
                value:
                  id: example-id
                  resourceIds:
                  - example-resourceIds_item
                  feature: ACTIVITY
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /sspm/identity/v1/{saasInstanceId}/tickets/{ticketKey}/issues:
    get:
      summary: Palo Alto Networks Get Ticket Issues
      description: "Retrieve a list of issues linked to a specific ticket for the given software as a service (SaaS) instance. \nThis helps in tracking and managing remediation or investigation items."
      operationId: saas_instances_tickets_issues_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseMapStringObject'
              examples:
                SaasInstancesTicketsIssuesGet200Example:
                  summary: Default saas_instances_tickets_issues_get 200 response
                  x-microcks-default: true
                  value:
                    total: 300
                    items:
                    - {}
                    - {}
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
        example: '290291'
      - name: ticketKey
        in: path
        required: true
        schema:
          type: string
        example: example-ticketKey
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
        example: 581
      - name: page
        in: query
        schema:
          format: int32
          type: integer
        example: 147
      - name: x-ps-tenant
        in: header
        schema:
          type: string
        example: example-x-ps-tenant
      tags:
      - SaaS Instance
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    ListResponseSaaSInstanceInfo:
      type: object
      properties:
        total:
          format: int64
          type: integer
          example: 345
        items:
          type: array
          items:
            $ref: '#/components/schemas/SaaSInstanceInfo'
          example:
          - displayName: Production Agent 13
            saasInstanceId: '806450'
            appType: custom
    Instant:
      format: date-time
      type: string
      example: 2022-03-10 16:15:50+00:00
    ListResponseMapStringObject:
      type: object
      properties:
        total:
          format: int64
          type: integer
          example: 300
        items:
          type: array
          items:
            type: object
          example:
          - {}
          - {}
    SaaSInstanceInfo:
      type: object
      properties:
        displayName:
          type: string
          example: Staging Policy 12
        saasInstanceId:
          type: string
          example: '949811'
        appType:
          type: string
          example: advanced
    CreateTicketRequest:
      required:
      - resourceIds
      - feature
      - integrationId
      - type
      - issueTypeId
      - summary
      type: object
      properties:
        resourceIds:
          type: array
          items:
            type: string
          example:
          - example-resourceIds_item
          - example-resourceIds_item
        feature:
          $ref: '#/components/schemas/Feature'
        integrationId:
          type: string
          example: '834310'
        type:
          type: string
          example: advanced
        issueTypeId:
          type: string
          example: '702842'
        summary:
          type: string
          example: Threat Security malware network rule threat on network threat policy.
        description:
          type: string
          example: Configured incident applied traffic endpoint monitoring rule.
        settings:
          type: object
          additionalProperties:
            type: string
          example: {}
    UnlinkTicketRequest:
      required:
      - id
      - feature
      type: object
      properties:
        id:
          type: string
          example: example-id
        resourceIds:
          type: array
          items:
            type: string
          example:
          - example-resourceIds_item
        feature:
          $ref: '#/components/schemas/Feature'
    DownloadCsvRequest:
      required:
      - userFullName
      - userEmail
      - service
      type: object
      properties:
        userFullName:
          type: string
          example: soc-analyst
        userEmail:
          type: string
          example: example-userEmail
        service:
          type: string
          example: example-service
    Ticket:
      type: object
      properties:
        id:
          type: string
          example: example-id
        tenant:
          type: string
          example: example-tenant
        saasInstanceId:
          type: string
          example: '155449'
        resourceIds:
          type: string
          example: example-resourceIds
        feature:
          type: string
          example: example-feature
        users:
          type: string
          example: example-users
        integrationId:
          type: string
          example: '300696'
        type:
          type: string
          example: advanced
        ticketKey:
          type: string
          example: example-ticketKey
        ticketUrl:
          type: string
          example: example-ticketUrl
        summary:
          type: string
          example: Suspicious detected traffic alert investigation endpoint firewall traffic monitoring.
        createdAt:
          $ref: '#/components/schemas/Instant'
    ListResponseTicket:
      type: object
      properties:
        total:
          format: int64
          type: integer
          example: 998
        items:
          type: array
          items:
            $ref: '#/components/schemas/Ticket'
          example:
          - id: example-id
            tenant: example-tenant
            saasInstanceId: '788637'
            resourceIds: example-resourceIds
            feature: example-feature
            users: example-users
            integrationId: '917387'
            type: custom
            ticketKey: example-ticketKey
            ticketUrl: example-ticketUrl
            summary: Configured applied suspicious violation malware traffic endpoint on.
            createdAt: &id004 2022-03-10 16:15:50+00:00
          - id: example-id
            tenant: example-tenant
            saasInstanceId: '430821'
            resourceIds: example-resourceIds
            feature: example-feature
            users: example-users
            integrationId: '571142'
            type: advanced
            ticketKey: example-ticketKey
            ticketUrl: example-ticketUrl
            summary: Applied rule investigation applied firewall incident network network Security blocked.
            createdAt: *id004
    ListResponseSaaSAccount:
      type: object
      properties:
        total:
          format: int64
          type: integer
          example: 36
        items:
          type: array
          items:
            $ref: '#/components/schemas/SaaSAccount'
          example:
          - id: example-id
            saasProviderId: '593378'
            tenant: example-tenant
            saasInstanceId: '357865'
            jobId: '954046'
            appId: '116192'
            appType: standard
            accountType: custom
            accountName: Primary Sensor 93
            email: jsmith@example.com
            isLocal: true
            isOrphaned: false
            isElevated: true
            ticketKey: example-ticketKey
            ticketUrl: example-ticketUrl
            roles: example-roles
            creator: example-creator
            linkedHumanAccounts: example-linkedHumanAccounts
            saasProviderNhiName: Staging Policy 58
            lastModifiedTime: &id005 2022-03-10 16:15:50+00:00
            lastLoginTime: *id005
            isNonHuman: false
            createdTime: *id005
            latestScanTime: *id005
            lastCredentialsRotated: *id005
            rotatedBy: example-rotatedBy
            githubOrgName: Corporate Sensor 58
            credentialsExpiresAt: *id005
          - id: example-id
            saasProviderId: '168374'
            tenant: example-tenant
            saasInstanceId: '608799'
            jobId: '926117'
            appId: '762667'
            appType: standard
            accountType: advanced
            accountName: Staging Agent 78
            email: jane.doe@example.com
            isLocal: true
            isOrphaned: false
            isElevated: false
            ticketKey: example-ticketKey
            ticketUrl: example-ticketUrl
            roles: example-roles
            creator: example-creator
            linkedHumanAccounts: example-linkedHumanAccounts
            saasProviderNhiName: Branch Sensor 45
            lastModifiedTime: *id005
            lastLoginTime: *id005
            isNonHuman: true
            createdTime: *id005
            latestScanTime: *id005
            lastCredentialsRotated: *id005
            rotatedBy: example-rotatedBy
            githubOrgName: Corporate Gateway 50
            credentialsExpiresAt: *id005
    SaaSActivity:
      type: object
      properties:
        id:
          type: string
          example: example-id
        userId:
          type: string
          example: '558697'
        tenant:
          type: string
          example: example-tenant
        saasInstanceId:
          type: string
          example: '278773'
        appType:
          type: string
          example: standard
        resourceType:
          type: string
          example: custom
        resourceName:
          type: string
          example: Staging Agent 77
        activityType:
          type: string
          example: advanced
        clientIP:
          type: string
          example: example-clientIP
        location:
          type: string
          example: example-location
        userAgent:
          type: string
          example: example-userAgent
        summary:
          type: string
          example: Traffic network investigation policy applied activity incident incident monitoring suspicious incident.
        rawData:
          type: string
          example: example-rawData
        activityDateTime:
          $ref: '#/components/schemas/Instant'
        createdAt:
          $ref: '#/components/schemas/Instant'
    SaaSAccount:
      type: object
      properties:
        id:
          type: string
          example: example-id
        saasProviderId:
          type: string
          example: '703346'
        tenant:
          type: string
          example: example-tenant
        saasInstanceId:
          type: string
          example: '765566'
        jobId:
          type: string
          example: '560015'
        appId:
          type: string
          example: '648367'
        appType:
          type: string
          example: custom
        accountType:
          type: string
          example: advanced
        accountName:
          type: string
          example: Branch Policy 58
        email:
          type: string
          example: analyst1@example.com
        isLocal:
          type: boolean
          example: false
        isOrphaned:
          type: boolean
          example: true
        isElevated:
          type: boolean
          example: true
        ticketKey:
          type: string
          example: example-ticketKey
        ticketUrl:
          type: string
          example: example-ticketUrl
        roles:
          type: string
          example: example-roles
        creator:
          type: string
          example: example-creator
        linkedHumanAccounts:
          type: string
          example: example-linkedHumanAccounts
        saasProviderNhiName:
          type: string
          example: Production Agent 14
        lastModifiedTime:
          $ref: '#/components/schemas/Instant'
        lastLoginTime:
          $ref: '#/components/schemas/Instant'
        isNonHuman:
          type: boolean
          example: false
        createdTime:
          $ref: '#/components/schemas/Instant'
        latestScanTime:
          $ref: '#/components/schemas/Instant'
        lastCredentialsRotated:
          $ref: '#/components/schemas/Instant'
        rotatedBy:
          type: string
          example: example-rotatedBy
        githubOrgName:
          type: string
          example: Staging Policy 17
        credentialsExpiresAt:
          $ref: '#/components/schemas/Instant'
    Feature:
      enum:
      - ENROLLMENT
      - ACTIVITY
      - LOGOUT
      - IDENTITY_NHI
      - IDENTITY_ACTIVITY
      type: string
    ListResponseSaaSActivity:
      type: object
      properties:
        total:
          format: int64
          type: integer
          example: 758
        items:
          type: array
          items:
            $ref: '#/components/schemas/SaaSActivity'
          example:
          - id: example-id
            userId: '561798'
            tenant: example-tenant
            saasInstanceId: '246211'
            appType: custom
            resourceType: advanced
            resourceName: Staging Agent 22
            activityType: standard
            clientIP: example-clientIP
            location: example-location
            userAgent: example-userAgent
            summary: Configured policy configured configured violation suspicious malware.
            rawData: example-rawData
            activityDateTime: &id006 2022-03-10 16:15:50+00:00
            createdAt: *id006
          - id: example-id
            userId: '362728'
            tenant: example-tenant
            saasInstanceId: '778286'
            appType: custom
            resourceType: advanced
            resourceName: Primary Gateway 93
            activityType: advanced
            clientIP: example-clientIP
            location: example-location
            userAgent: example-userAgent
            summary: Network incident threat rule investigation endpoint.
            rawData: example-rawData
            activityDateTime: *id006
            createdAt: *id006
  securitySchemes:
    oauth2Bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token for SASE platform authentication. Obtain using the client_credentials grant with your SASE service account client ID and client secret.