openapi: 3.2.0
info:
  title: Palo Alto Networks User Profile API
  version: Latest
  contact: {}
  description: 'Operations tagged User Profile across 2 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-userprofile-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: 'Manage your Prisma Cloud user profiles.

    '
  name: User Profile
paths:
  /user/me:
    get:
      description: Returns the current user's personal profile information.
      operationId: get-my-profile
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MultiRoleUserProfile1'
          description: successful operation
        '400':
          description: user_inactive_or_not_exist
        '500':
          description: failed_fetch_user_profile
      security:
      - x-redlock-auth: []
      summary: Profile
      tags:
      - User Profile
    put:
      description: "Updates the current user's personal profile information.  \n\nThis request supports four optional request body parameters, which you can see in the JSON example below:\n```\n{\n  \"defaultRoleId\": \"\",\n  \"firstName\": \"\",\n  \"lastName\": \"\",\n  \"timeZone\": \"\",  \n}\n```\n\nThe red **required** labels in the request body schema below apply only when you create a new user profile, so the labels don't apply to this request.\n"
      operationId: update-my-profile
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultiRoleUserProfile1'
        description: Model containing user profile
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: empty_user_profile_provided / missing_first_name / missing_time_zone / invalid_time_zone / user_inactive_or_not_exist / default_role_not_belonging_to_user_role_list / invalid_user_role
        '403':
          description: cannot_disable_own_profile / access_keys_cannot_update_owner_profile
        '500':
          description: failed_update_user_profile
      security:
      - x-redlock-auth: []
      summary: Update Profile
      tags:
      - User Profile
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /v3/user:
    get:
      description: Lists all users and service accounts for your tenant.
      operationId: get-user-profiles-v3
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/UserAccountModel'
                type: array
          description: successful operation
        '500':
          description: failed_fetch_user_profile
      security:
      - x-redlock-auth: []
      summary: List Users V3
      tags:
      - User Profile
    post:
      description: "Adds either a user profile or a service account profile.  \n\nThe required request body parameters differ, depending on whether you are adding a user account or a service account. Specify whether \nyou're adding a user account or service account through the request parameter **type**.\n\nThe required parameters to add a user account are:\n\n* **email**\n* **firstName**\n* **lastName**\n* **roleIds**\n* **defaultRoleId**\n* **timeZone**\n\nThe required parameters to add a service account are:\n\n* **username**\n* **accessKeyName**\n* **accessKeyExpiration** (Required only if **enableKeyExpiration** is **true**)\n* **defaultRoleId**\n* **timeZone**\n"
      operationId: add-user-v3
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserAccountModel'
        description: Model for User Account
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateUserAccessKeyResponseModel'
          description: successful operation
        '400':
          description: empty_user_profile_provided / missing_email / wrong_email_format / missing_first_name / missing_time_zoneinvalid_time_zone /  missing_required_parameter / no_role_assigned_to_user / exceeding_role_limit_number / default_role_not_belonging_to_user_role_list / invalid_user_role
        '409':
          description: duplicate_user_name
        '500':
          description: failed_add_user_profile
      security:
      - x-redlock-auth: []
      summary: Add User Profile V3
      tags:
      - User Profile
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /v2/user:
    get:
      description: Returns a list of all the users belonging to the same tenant. Response includes multiple roles assigned to each user.
      operationId: get-user-profiles-v2
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/UserProfileModel'
                type: array
          description: successful operation
        '500':
          description: failed_fetch_user_profile
      security:
      - x-redlock-auth: []
      summary: List Users V2
      tags:
      - User Profile
    post:
      description: Adds a new administrative user. Supports multiple roles for a single user.
      operationId: add-user-v2
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultiRoleUserProfile1'
        description: Model containing user profile
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: empty_user_profile_provided / missing_email / wrong_email_format / missing_first_name / missing_time_zoneinvalid_time_zone /  missing_required_parameter / no_role_assigned_to_user / exceeding_role_limit_number / default_role_not_belonging_to_user_role_list / invalid_user_role
        '409':
          description: duplicate_user_name
        '500':
          description: failed_add_user_profile
      security:
      - x-redlock-auth: []
      summary: Add User Profile V2
      tags:
      - User Profile
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /v2/user/{id}:
    get:
      description: Returns the user profile for the specified email ID. Supports multiple roles for a single user.
      operationId: get-user-profile-v2
      parameters:
      - description: User email
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserProfileModel'
          description: successful operation
        '400':
          description: user_inactive_or_not_exist
        '500':
          description: failed_fetch_user_profile
      security:
      - x-redlock-auth: []
      summary: Get User Profile V2
      tags:
      - User Profile
    put:
      description: "Updates an administrative user's profile. Supports multiple roles for a single user.  \n\nThe current **email** of the user whose profile you want to update is a required request parameter. All other request parameters are optional. The red **required** labels in the request body schema below apply only when you create a new user profile.\n"
      operationId: update-profile-v2
      parameters:
      - description: User email
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultiRoleUserProfile1'
      responses:
        '200':
          description: successful operation
        '400':
          description: empty_user_profile_provided / missing_first_name / missing_time_zone / invalid_time_zone / user_inactive_or_not_exist / exceeding_role_limit_number / default_role_not_belonging_to_user_role_list / invalid_user_role / invalid_user_role
        '403':
          description: cannot_remove_current_log_in_role
        '500':
          description: failed_update_user_profile
      security:
      - x-redlock-auth: []
      summary: Update User Profile V2
      tags:
      - User Profile
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /user/{id}:
    delete:
      description: Deletes a user or service account profile.
      operationId: delete-user
      parameters:
      - description: User email or service account name
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      responses:
        '200':
          description: successful operation
        '400':
          description: user_inactive_or_not_exist
        '403':
          description: cannot_delete_own_profile
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Delete User Profile
      tags:
      - User Profile
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /user/{id}/status/{enabled}:
    patch:
      description: Enables or disables a user profile.
      operationId: update-user-profile
      parameters:
      - description: User email
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: Status to set
        in: path
        name: enabled
        required: true
        schema:
          type: boolean
      responses:
        '200':
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: Update User Status
      tags:
      - User Profile
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /user/name:
    get:
      description: Returns a list of emails for all non-deleted users in the system.
      operationId: get-usernames
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  additionalProperties:
                    type: string
                  type: object
                type: array
          description: successful operation
        '500':
          description: failed_fetch_users_emails
      security:
      - x-redlock-auth: []
      summary: List User Emails
      tags:
      - User Profile
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /user/domain:
    get:
      description: Returns a list of domains in allow list.
      operationId: email-domains
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  type: string
                type: array
          description: successful operation
        '400':
          description: no_user_added
        '500':
          description: failed_fetch_email_domain_allow_list
      security:
      - x-redlock-auth: []
      summary: List Email Domains
      tags:
      - User Profile
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /user/saml/bypass:
    get:
      description: "Returns a list of users who can log in via both SAML provider and username/password flows.  \n\nThe request body is an array of emails to be bypassed.\n```\n   [ \"jon.snow@example.com\", \"daenerys@example.com\" ]\n```\n"
      operationId: get-sso-bypass-allowed-users
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  type: string
                type: array
                uniqueItems: true
          description: successful operation
        '500':
          description: failed_fetch_sso_bypass_allowed_users
      security:
      - x-redlock-auth: []
      summary: List SSO Bypass Allowed Users
      tags:
      - User Profile
    put:
      description: Given a list of Prisma Cloud user emails, enables each user in the list to log into Prisma Cloud through either a SAML provider or direct user name and password entry.
      operationId: update-sso-bypass-allowed-users
      requestBody:
        content:
          application/json:
            schema:
              items:
                type: string
              type: array
        description: SSO Bypass allowed users
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: missing_sso_bypass_allowed_users
        '500':
          description: failed_update_sso_bypass_allowed_users
      security:
      - x-redlock-auth: []
      summary: Update SSO Bypass Allowed Users
      tags:
      - User Profile
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
components:
  schemas:
    UserProfileModel:
      description: Model containing user profile
      properties:
        accessKeysAllowed:
          description: Access keys allowed
          type: boolean
        displayName:
          description: Display name
          readOnly: true
          type: string
        email:
          description: Email ID
          type: string
        enabled:
          description: Enabled
          readOnly: true
          type: boolean
        firstName:
          description: First name. Maximum length is 300 characters.
          type: string
        lastLoginTs:
          description: Last login time
          format: int64
          readOnly: true
          type: integer
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time profile was last updated
          format: int64
          readOnly: true
          type: integer
        lastName:
          description: Last name.  Maximum length is 300 characters.
          type: string
        role:
          additionalProperties:
            type: string
          description: Role
          readOnly: true
          type: object
        roleId:
          description: Role ID
          type: string
        roleType:
          description: Role type
          readOnly: true
          type: string
        timeZone:
          description: Time zone (e.g. America/Los_Angeles)
          type: string
      required:
      - email
      - firstName
      - lastName
      - roleId
      - timeZone
      type: object
    UserAccountModel:
      description: Model for User Account
      properties:
        accessKeyExpiration:
          description: Access key expiration timestamp in milliseconds
          format: int64
          type: integer
        accessKeyName:
          description: Access key name
          type: string
        accessKeysAllowed:
          description: Access keys allowed
          type: boolean
        accessKeysCount:
          description: Access key count
          format: int32
          readOnly: true
          type: integer
        activeRole:
          allOf:
          - $ref: '#/components/schemas/UserProfileRoleDetailModel'
          - description: Active Role Info
            readOnly: true
        defaultRoleId:
          description: Default Role ID
          type: string
        displayName:
          description: Display name
          readOnly: true
          type: string
        email:
          description: Email ID
          type: string
        enableKeyExpiration:
          description: true = Enable access key expiration. Default is false.
          type: boolean
        enabled:
          description: Enabled
          readOnly: true
          type: boolean
        firstName:
          description: First name. Maximum length is 300 characters.
          type: string
        lastLoginTs:
          description: Last login time
          format: int64
          readOnly: true
          type: integer
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time profile was last updated
          format: int64
          readOnly: true
          type: integer
        lastName:
          description: Last name.  Maximum length is 300 characters.
          type: string
        roleIds:
          description: Role IDs
          items:
            type: string
          type: array
        roles:
          description: All Role Info
          items:
            $ref: '#/components/schemas/UserProfileRoleDetailModel'
          readOnly: true
          type: array
        timeZone:
          description: Time zone (e.g. America/Los_Angeles)
          type: string
        type:
          description: User type. Default is USER_ACCOUNT.
          enum:
          - USER_ACCOUNT
          - SERVICE_ACCOUNT
          type: string
        username:
          description: User or service account name. Maximum length is 300 characters.
          type: string
      type: object
    CreateUserAccessKeyResponseModel:
      description: Model for create user access key response
      properties:
        id:
          description: Access key ID
          type: string
        secretKey:
          description: Access key secret
          type: string
      type: object
    UserProfileRoleDetailModel:
      description: Model for User Profile Role Detail
      properties:
        id:
          description: User Role ID
          readOnly: true
          type: string
        name:
          description: User Role Name
          readOnly: true
          type: string
        onlyAllowCIAccess:
          description: true = Allow only CI Access for Build and Deploy security roles
          readOnly: true
          type: boolean
        onlyAllowComputeAccess:
          description: true = Allow only Compute Access for reduced system admin roles
          readOnly: true
          type: boolean
        onlyAllowReadAccess:
          description: true = Allow only Read Access for
          readOnly: true
          type: boolean
        type:
          description: User Role Type (Default or Custom Permission Group Name).
          readOnly: true
          type: string
      type: object
    MultiRoleUserProfile1:
      description: Model containing user profile
      properties:
        accessKeysAllowed:
          description: Access keys allowed
          type: boolean
        activeRole:
          allOf:
          - $ref: '#/components/schemas/UserProfileRoleDetailModel'
          - description: Active Role Info
            readOnly: true
        defaultRoleId:
          description: Default Role ID
          type: string
        displayName:
          description: Display name
          readOnly: true
          type: string
        email:
          description: Email ID
          type: string
        enabled:
          description: Enabled
          readOnly: true
          type: boolean
        firstName:
          description: First name. Maximum length is 300 characters.
          type: string
        lastLoginTs:
          description: Last login time
          format: int64
          readOnly: true
          type: integer
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time profile was last updated
          format: int64
          readOnly: true
          type: integer
        lastName:
          description: Last name.  Maximum length is 300 characters.
          type: string
        roleIds:
          description: Role IDs
          items:
            type: string
          type: array
        roles:
          description: All Role Info
          items:
            $ref: '#/components/schemas/UserProfileRoleDetailModel'
          readOnly: true
          type: array
        timeZone:
          description: Time zone (e.g. America/Los_Angeles)
          type: string
      required:
      - defaultRoleId
      - email
      - firstName
      - lastName
      - roleIds
      - timeZone
      type: object
    MultiRoleUserProfile:
      description: Model containing user profile
      properties:
        accessKeysAllowed:
          description: Access keys allowed
          type: boolean
        activeRole:
          allOf:
          - $ref: '#/components/schemas/UserProfileRoleDetailModel'
          - description: Active Role Info
            readOnly: true
        defaultRoleId:
          description: Default Role ID
          type: string
        displayName:
          description: Display name
          readOnly: true
          type: string
        email:
          description: Email ID
          type: string
        enabled:
          description: Enabled
          readOnly: true
          type: boolean
        firstName:
          description: First name. Maximum length is 300 characters.
          type: string
        lastLoginTs:
          description: Last login time
          format: int64
          readOnly: true
          type: integer
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time profile was last updated
          format: int64
          readOnly: true
          type: integer
        lastName:
          description: Last name.  Maximum length is 300 characters.
          type: string
        roleIds:
          description: Role IDs
          items:
            type: string
          type: array
        roles:
          description: All Role Info
          items:
            $ref: '#/components/schemas/UserProfileRoleDetailModel'
          readOnly: true
          type: array
        timeZone:
          description: Time zone (e.g. America/Los_Angeles)
          type: string
      required:
      - defaultRoleId
      - email
      - firstName
      - lastName
      - roleIds
      - timeZone
      type: object
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey
x-refined-from:
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json
- palo-alto-cspm-userprofile-openapi.json