openapi: 3.2.0
info:
  title: Authentication and RBAC API's SSO API
  contact:
    name: Platform
    url: https://panw-rnd.slack.com/archives/C01DQJBJ7LJ
  version: '1.0'
  description: On Prisma Cloud, you can enable single sign-on (SSO) using an Identity Provider (IdP) that supports Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), such as Okta, Microsoft Active Directory Federation Services (ADFS), Azure Active Directory (AD), Google, or OneLogin. Prisma Cloud System Administrators can use the following APIs to configure tenant SSO.
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
security:
- CertAuth: []
- ServiceJwt: []
- UserJwt: []
- x-redlock-auth: []
tags:
- name: SSO
  description: On Prisma Cloud, you can enable single sign-on (SSO) using an Identity Provider (IdP) that supports Security Assertion Markup Language (SAML) or OpenID Connect (OIDC), such as Okta, Microsoft Active Directory Federation Services (ADFS), Azure Active Directory (AD), Google, or OneLogin. Prisma Cloud System Administrators can use the following APIs to configure tenant SSO.
paths:
  /authn/v1/saml/config:
    get:
      tags:
      - SSO
      summary: Get SAML Configuration
      description: Used by System Admins to get the SAML Configuration for the tenancy
      operationId: get-saml-config
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SsoConfig'
        '401':
          description: Authentication error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SsoConfig'
        '403':
          description: Authorization error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SsoConfig'
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SsoConfig'
      security:
      - x-redlock-auth: []
      x-microservice: 'true'
      x-public: 'true'
    put:
      tags:
      - SSO
      summary: Update SAML Configuration
      description: Used by System Admins to update the SAML Configuration for the tenancy
      operationId: update-saml-config
      parameters:
      - name: clientIp
        in: header
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SsoConfig'
        required: true
      responses:
        '200':
          description: Successful operation
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
        '403':
          description: Authorization error
        '429':
          description: Too many requests
      security:
      - x-redlock-auth: []
      x-microservice: 'true'
      x-public: 'true'
    post:
      tags:
      - SSO
      summary: Create SAML Configuration
      description: Used by System Admins to create the SAML Configuration for the tenancy
      operationId: create-saml-config
      parameters:
      - name: clientIp
        in: header
        required: false
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SsoConfig'
        required: true
      responses:
        '200':
          description: Successful operation
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
        '403':
          description: Authorization error
        '429':
          description: Too many requests
      security:
      - x-redlock-auth: []
      x-microservice: 'true'
      x-public: 'true'
  /authn/api/v1/oauth2/config:
    get:
      tags:
      - SSO
      summary: Get OIDC Configuration
      description: Get the OAuth2 configuration details of a tenant that is used by OpenID Connect(OIDC).
      operationId: get-oauth2-config
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2ConfigDetail'
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2ConfigDetail'
        '403':
          description: Authorization error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2ConfigDetail'
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuth2ConfigDetail'
      security:
      - x-redlock-auth: []
      x-ga: 23.10.1
      x-public: 'true'
    put:
      tags:
      - SSO
      summary: Update OIDC Configuration
      description: Updates all the parameters of an existing OAuth2 configuration that is used by OpenID Connect(OIDC).
      operationId: update-oauth2-config
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuth2ConfigDetail'
        required: true
      responses:
        '204':
          description: Successful operation
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
        '403':
          description: Authorization error
        '429':
          description: Too many requests
      security:
      - x-redlock-auth: []
      x-ga: 23.10.1
      x-public: 'true'
    post:
      tags:
      - SSO
      summary: Create an OIDC Configuration
      description: Create an OAuth2 configuration for a given tenant to be used by OpenID Connect(OIDC).
      operationId: create-oauth2-config
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuth2ConfigDetail'
        required: true
      responses:
        '201':
          description: Successful operation
          content:
            application/json:
              schema:
                type: string
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
          content:
            application/json:
              schema:
                type: string
        '403':
          description: Authorization error
          content:
            application/json:
              schema:
                type: string
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                type: string
      security:
      - x-redlock-auth: []
      x-ga: 23.10.1
      x-public: 'true'
    patch:
      tags:
      - SSO
      summary: Update OIDC Configuration Partially
      description: Updates only the specified parameters of an existing OAuth2 configuration that is used by OpenID Connect(OIDC).
      operationId: patch-oauth2-config
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuth2ConfigDetail'
        required: true
      responses:
        '204':
          description: Successful operation
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '401':
          description: Authentication error
        '403':
          description: Authorization error
        '429':
          description: Too many requests
      security:
      - x-redlock-auth: []
      x-ga: 23.10.1
      x-public: 'true'
  /authn/api/v1/oauth2/login:
    get:
      tags:
      - SSO
      summary: Get OIDC Login URL
      description: Get the OIDC login URL for the tenant.
      operationId: get-oidc-login-url
      parameters:
      - name: user_name
        in: query
        description: User name requesting the login URL.
        required: false
        schema:
          type: string
      - name: prisma_id
        in: query
        description: Prisma ID for the tenant of the user requesting the login.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: string
              example:
                url: https://prismacloud.io/authn/api/v1/oauth2/authorization/b5229d13-d2a2-4469-b9f8-1912cb11c2eb
        '400':
          description: Client error
          headers:
            x-redlock-status:
              description: error description
              style: simple
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpringErrorResponse'
        '429':
          description: Too many requests
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  type: string
      x-ga: 23.10.1
      x-public: 'true'
      security:
      - x-redlock-auth: []
components:
  schemas:
    OAuth2ConfigDetail:
      required:
      - clientId
      - idpAuthUri
      - issuer
      - scopes
      - tokenUri
      type: object
      properties:
        id:
          type: string
          description: Id
          format: uuid
          readOnly: true
        prismaId:
          type: integer
          description: Prisma ID of the tenant.
          format: int64
          readOnly: true
        clientId:
          type: string
          description: Client ID obtained after Identity Provider(IdP) configuration.
        clientSecret:
          type: string
          description: Secret for the client id
          writeOnly: true
        issuer:
          type: string
          description: The identifier of the OpenID Connect(OIDC) provider.
        scopes:
          type: array
          description: Identifiers used to specify what access privileges are being requested.
          example: '[openid, email, profile]'
          items:
            type: string
            description: Identifiers used to specify what access privileges are being requested.
            example: '[openid, email, profile]'
        grantType:
          type: string
          description: Grant types are a way to specify how a client wants to interact with an Identity Provider(IdP).
          enum:
          - authorization_code
        withPkce:
          type: boolean
          description: Using proof key for code exchange(PKCE) as additional verification.  PKCE ensures that only the client that requests the access token can redeem it.
          enum:
          - true
          - false
        idpAuthUri:
          type: string
          description: The URL of the authentication endpoint on the Identity Provider(IdP).
        tokenUri:
          type: string
          description: The Identity Provider token endpoint URL for obtaining access and ID tokens.
        jwkSetUri:
          type: string
          description: The URL of the Identity Provider(IdP) JSON Web Key Set document.This document contains signing keys that are used to validate the signatures from the provider.
        endSessionUri:
          type: string
          description: The URL used to sign out the user from the Identity Provider(IdP).
        isActive:
          type: boolean
          description: True to enable SSO using OIDC; False otherwise.
          enum:
          - true
          - false
        isJitEnabled:
          type: boolean
          description: Is JIT enabled
          enum:
          - true
          - false
        jitRoleClaimName:
          type: string
          description: Token claim providing the name of Prisma Cloud role for user.
        jitDefaultRoleId:
          type: string
          description: Default Prisma Cloud role to use for JIT when claim is missing or undefined.
        pcAuthUri:
          type: string
          description: Prisma Cloud endpoint URL to begin the authentication flow.
          readOnly: true
        pcRelayUri:
          type: string
          description: Prisma Cloud callback endpoint URL from the IdP during authentication.
          readOnly: true
        lastLoginErrors:
          type: array
          description: Recent OIDC login errors.
          readOnly: true
          items:
            type: string
            description: Recent OIDC login errors.
            readOnly: true
        createdBy:
          type: string
          description: User who created the resource.
          readOnly: true
        createdTs:
          type: integer
          description: Created on timestamp.
          format: int64
          readOnly: true
        lastModifiedBy:
          type: string
          description: User who made the last update.
          readOnly: true
        lastModifiedTs:
          type: integer
          description: Last update timestamp.
          format: int64
          readOnly: true
        clientSecretIsBlank:
          type: boolean
          description: True if client secret is not configured; False otherwise.
          readOnly: true
          enum:
          - true
          - false
    SsoConfig:
      type: object
      properties:
        identityProvider:
          type: string
          description: Identity Provider Issuer URI
        certificate:
          type: string
          description: Identity Provider Certificate
        enabled:
          type: boolean
          description: Is the configuration enabled?
          default: false
        logoutRedirectUrl:
          type: string
          description: Identity Provider Logout URL
        relayStateParamName:
          type: string
          description: Identity Provider Relay State Param
        lastLoginErrors:
          type: array
          description: Last Login Errors
          readOnly: true
          items:
            type: string
            description: Last Login Errors
            readOnly: true
        audienceUri:
          type: string
          description: Audience URI or Prisma Cloud SP-Entity-Id
          readOnly: true
        autoProvisionEnabled:
          type: boolean
          description: Enable JIT provisioning
          default: false
        requireAccessSamlUrlPublic:
          type: boolean
          description: Skip Public address check for Access SAML URL
          default: true
        autoProvisionSamlEmail:
          type: string
          description: JIT provisioning SAML Attribute - Email
        autoProvisionSamlFirstName:
          type: string
          description: JIT provisioning SAML Attribute - First name
        autoProvisionSamlLastName:
          type: string
          description: JIT provisioning SAML Attribute - Last name
        autoProvisionSamlRole:
          type: string
          description: JIT provisioning SAML Attribute - Role
        autoProvisionSamlTimezone:
          type: string
          description: JIT provisioning SAML Attribute - TZ
        redLockAccessSamlUrl:
          type: string
          description: Identity Provider Configured Prisma Cloud Access URL
    ErrorDetails:
      required:
      - message
      - name
      type: object
      properties:
        name:
          type: string
        message:
          type: string
    SpringErrorResponse:
      required:
      - error
      - message
      - path
      - status
      - timestamp
      type: object
      properties:
        timestamp:
          type: string
        status:
          type: integer
          format: int32
        error:
          type: string
        errorDetails:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetails'
        message:
          type: string
        path:
          type: string
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
externalDocs:
  description: Platform Wiki Documentation
  url: https://redlock.atlassian.net/wiki/spaces/RED/pages/2744877602/Platform+AuthN+Integration+Template