openapi: 3.2.0
info:
  contact: {}
  description: 'The Cloud NGFW for AWS uses a Cloud Formation Template (CFT) stack to onboard an AWS account and create the roles needed to access the resources in your AWS environment.

    '
  title: User Onboarding using Endpoint Role User Onboarding Member Accounts API
  version: 1.0.0
servers:
- url: https://api.us-east-1.aws.cloudngfw.paloaltonetworks.com
tags:
- name: UserOnboarding-MemberAccounts
paths:
  /v1/mgmt/xaccountroles:
    get:
      description: "Lists all accounts on-boarded using endpoint role.          \n"
      operationId: get-v1-mgmt-xaccountroles
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListXAccountRolesRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListXAccountRolesResponse'
          description: OK
      summary: List Member accounts and cross account roles
      tags:
      - UserOnboarding-MemberAccounts
  /v1/mgmt/xaccountroles/{accountid}:
    get:
      description: 'Retrieve the information of a specific account.

        '
      operationId: get-v1-mgmt-xaccountroles-accountid
      parameters:
      - description: 'The unique ID of the account.

          '
        in: path
        name: accountid
        required: true
        schema:
          type: string
      - description: 'Retrieve the information of a specific account.

          '
        in: query
        name: describeaccount
        required: false
        schema:
          default: false
          title: Describeaccount
          type: boolean
      - description: 'The unique identifier of the VPC.

          '
        in: query
        name: vpcid
        required: false
        schema:
          title: Vpcid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribeXAccountRoleArnResponse'
          description: OK
      summary: Describe Member accounts and cross account Roles
      tags:
      - UserOnboarding-MemberAccounts
components:
  schemas:
    DescribeXAccountRoleArnResponse.VpcDetails:
      additionalProperties: false
      properties:
        SubnetInformations:
          description: 'Details of the subnet.

            '
          items:
            $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.SubnetDetails'
          title: Subnetinformations
          type: array
        VpcId:
          description: 'The unique identifier of the VPC.

            '
          title: Vpcid
          type: string
        VpcName:
          description: 'Name of the VPC.

            '
          title: Vpcname
          type: string
      required:
      - VpcId
      title: VpcDetails
      type: object
    DescribeXAccountRoleArnResponse.RuleStackRoles:
      additionalProperties: false
      properties:
        DecryptionRole:
          description: 'Decryption role permissions.

            '
          title: Decryptionrole
          type: string
      title: RuleStackRoles
      type: object
    DescribeXAccountRoleArnResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          description: "Default value of a successful response is 0. Any other number indicates an error code.  \n\n400—HTTP bad request\n* InvalidOperationException—Operation failed because it is not valid. For example, when you delete an NGFW or rulestack in use.\n* InvalidRequestException—Operation failed due to invalid request. For example, unsupported parameter name or value in the request.\n* LimitExceededException—Operation failed due to violation in limit settings.\n* ResourceNotFoundException—Unable to locate a resource using the parameters you provided.\n* ThrottlingException—Operation failed due to throttling limitations.   \n\n500—Bad request \n* InternalServerError—Your request is valid but Cloud NGFW could not perform the operation due to a system issue.\n"
          title: Errorcode
          type: integer
        Reason:
          description: 'The error description

            '
          title: Reason
          type: string
      title: Result
      type: object
    ListXAccountRolesResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          description: "Default value of a successful response is 0. Any other number indicates an error code.  \n\n400—HTTP bad request\n* InvalidOperationException—Operation failed because it is not valid. For example, when you delete an NGFW or rulestack in use.\n* InvalidRequestException—Operation failed due to invalid request. For example, unsupported parameter name or value in the request.\n* LimitExceededException—Operation failed due to violation in limit settings.\n* ResourceNotFoundException—Unable to locate a resource using the parameters you provided.\n* ThrottlingException—Operation failed due to throttling limitations.   \n\n500—Bad request \n* InternalServerError—Your request is valid but Cloud NGFW could not perform the operation due to a system issue.\n"
          title: Errorcode
          type: integer
        Reason:
          description: 'The error description

            '
          title: Reason
          type: string
      title: Result
      type: object
    DescribeXAccountRoleArnResponse.FirewallRoles:
      additionalProperties: false
      properties:
        EndpointRole:
          description: 'Endpoint role permissions.

            '
          title: Endpointrole
          type: string
        LoggingRole:
          description: 'Logging role permissions.

            '
          title: Loggingrole
          type: string
      title: FirewallRoles
      type: object
    ListXAccountRolesResponse.ResponseData:
      additionalProperties: false
      properties:
        AccountIds:
          description: 'The unique ID of the account.

            '
          items:
            maxLength: 12
            pattern: ^$|^[0-9]+$
            type: string
          title: Accountids
          type: array
        NextToken:
          description: 'If the number of accounts for retrieval exceeds the maximum you requested, Cloud NGFW returns a NextToken value in response. To retrieve the next batch of accounts, use this token in your next request.

            '
          maxLength: 2048
          minLength: 1
          pattern: ^[-0-9A-Za-z:\/+=]+$
          title: Nexttoken
          type: string
      title: ResponseData
      type: object
    DescribeXAccountRoleArnResponse.SubnetDetails:
      additionalProperties: false
      properties:
        SubnetId:
          description: 'The unique ID of the subnet in your VPC.

            '
          title: Subnetid
          type: string
        SubnetName:
          description: 'Name of the subnet.

            '
          title: Subnetname
          type: string
      required:
      - SubnetId
      title: SubnetDetails
      type: object
    ListXAccountRolesRequest:
      additionalProperties: false
      properties:
        MaxResults:
          default: 1024
          description: "The maximum number of accounts you want Cloud NGFW to return for this request. \n"
          maximum: 1024
          minimum: 1
          title: Maxresults
          type: integer
        NextToken:
          description: 'If the number of accounts for retrieval exceeds the maximum you requested, Cloud NGFW returns a NextToken value in response. To retrieve the next batch of accounts, use this token in your next request.

            '
          maxLength: 2048
          minLength: 1
          pattern: ^[-0-9A-Za-z:\/+=]+$
          title: Nexttoken
          type: string
      title: ListXAccountRolesRequest
      type: object
    ListXAccountRolesResponse:
      additionalProperties: false
      properties:
        Response:
          $ref: '#/components/schemas/ListXAccountRolesResponse.ResponseData'
          description: 'The API call response.

            '
        ResponseStatus:
          $ref: '#/components/schemas/ListXAccountRolesResponse.Result'
          description: 'The API call response status.

            '
      title: ListXAccountRolesResponse
      type: object
    DescribeXAccountRoleArnResponse.ResponseData:
      additionalProperties: false
      properties:
        AccountGroups:
          description: 'Combination of multiple cloud accounts with similar or different applications.

            '
          items:
            type: string
          title: Accountgroups
          type: array
        AccountId:
          description: 'The unique ID of the account.

            '
          maxLength: 12
          pattern: ^$|^[0-9]+$
          title: Accountid
          type: string
        AllowedMode:
          description: 'Specify the mode.

            '
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Allowedmode
          type: string
        AvailabilityZones:
          items:
            type: string
          title: Availabilityzones
          type: array
        CloudTrailRole:
          description: 'Supports a service-linked role for integration with AWS.

            '
          title: Cloudtrailrole
          type: string
        DefaultRole:
          description: 'The default IAM role.

            '
          title: Defaultrole
          type: string
        Firewall:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.FirewallRoles'
          description: 'Name of the firewall.

            '
        OnboardingStatus:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.AccountTableEntryStatus'
          description: 'The account onboarding status.

            '
        RuleStack:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.RuleStackRoles'
          description: 'Name of the rulestack.

            '
        VpcInformations:
          description: 'Details of the VPC.

            '
          items:
            $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.VpcDetails'
          title: Vpcinformations
          type: array
      title: ResponseData
      type: object
    DescribeXAccountRoleArnResponse.AccountTableEntryStatus:
      description: An enumeration.
      enum:
      - Success
      - Pending
      - Deleting
      - OffBoarding
      - DeleteFailed
      title: AccountTableEntryStatus
      type: string
    DescribeXAccountRoleArnResponse:
      additionalProperties: false
      properties:
        Response:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.Result'
      title: DescribeXAccountRoleArnResponse
      type: object