openapi: 3.2.0
info:
  contact: {}
  description: "Cloud NGFW requires you to onboard an AWS account to create and manage the resources required by Cloud NGFW. The Cloud NGFW service uses a CloudFormation Template (CFT) stack to create these roles needed for Cloud NGFW to access resources in your AWS environment.\n\n### Permission Policies\n\n| Action                   | Local Firewall Administrator  | Local Rulestack Administrator | Global Rulestack Administrator |\n| ------------------------ | :---------------------------: | :---------------------------: | :----------------------------: | \n| Put XAccount Roles       | ☐                       | ☐                       | ☐                        |\n| Describe XAccount Roles  | **☑**                   | **☑**                   | **☑**                    |                      \n| List Member Accounts     | **☑**                   | **☑**                   | **☑**                    | \n| Delete XAccount Roles    | ☐                       | ☐                       | ☐                        |\n"
  title: User Onboarding using Endpoint Role User Onboarding X Account Roles API
  version: 1.0.0
servers:
- url: https://api.us-east-1.aws.cloudngfw.paloaltonetworks.com
tags:
- name: UserOnboarding-XAccountRoles
paths:
  /v1/mgmt/xaccountroles:
    get:
      description: 'List all accounts that have been onboarded using endpoint role.

        '
      operationId: get-v1-mgmt-xaccountroles
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ListXAccountRolesRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListXAccountRolesResponse'
          description: OK
      summary: List onboarded accounts
      tags:
      - UserOnboarding-XAccountRoles
  /v1/mgmt/xaccountroles/{accountid}:
    get:
      description: 'Retrieve the configuration information for a specific account.

        '
      operationId: get-v1-mgmt-xaccountroles-accountid
      parameters:
      - description: 'The unique ID of the account.

          '
        in: path
        name: accountid
        required: true
        schema:
          type: string
      - description: ''
        in: query
        name: describeaccount
        required: false
        schema:
          default: false
          title: Describeaccount
          type: boolean
      - description: ''
        in: query
        name: vpcid
        required: false
        schema:
          title: Vpcid
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DescribeXAccountRoleArnResponse'
          description: OK
      summary: Retrieve account information
      tags:
      - UserOnboarding-XAccountRoles
components:
  schemas:
    DescribeXAccountRoleArnResponse.VpcDetails:
      additionalProperties: false
      properties:
        SubnetInformations:
          items:
            $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.SubnetDetails'
          title: Subnetinformations
          type: array
        VpcId:
          title: Vpcid
          type: string
        VpcName:
          title: Vpcname
          type: string
      required:
      - VpcId
      title: VpcDetails
      type: object
    DescribeXAccountRoleArnResponse.RuleStackRoles:
      additionalProperties: false
      properties:
        DecryptionRole:
          title: Decryptionrole
          type: string
      title: RuleStackRoles
      type: object
    DescribeXAccountRoleArnResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    ListXAccountRolesResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    DescribeXAccountRoleArnResponse.FirewallRoles:
      additionalProperties: false
      properties:
        EndpointRole:
          title: Endpointrole
          type: string
        LoggingRole:
          title: Loggingrole
          type: string
      title: FirewallRoles
      type: object
    ListXAccountRolesResponse.ResponseData:
      additionalProperties: false
      properties:
        AccountIds:
          items:
            maxLength: 12
            pattern: ^$|^[0-9]+$
            type: string
          title: Accountids
          type: array
        NextToken:
          maxLength: 2048
          minLength: 1
          pattern: ^[-0-9A-Za-z:\/+=]+$
          title: Nexttoken
          type: string
      title: ResponseData
      type: object
    DescribeXAccountRoleArnResponse.SubnetDetails:
      additionalProperties: false
      properties:
        SubnetId:
          title: Subnetid
          type: string
        SubnetName:
          title: Subnetname
          type: string
      required:
      - SubnetId
      title: SubnetDetails
      type: object
    ListXAccountRolesRequest:
      additionalProperties: false
      properties:
        MaxResults:
          default: 1024
          maximum: 1024
          minimum: 1
          title: Maxresults
          type: integer
        NextToken:
          maxLength: 2048
          minLength: 1
          pattern: ^[-0-9A-Za-z:\/+=]+$
          title: Nexttoken
          type: string
      title: ListXAccountRolesRequest
      type: object
    ListXAccountRolesResponse:
      additionalProperties: false
      properties:
        Response:
          $ref: '#/components/schemas/ListXAccountRolesResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/ListXAccountRolesResponse.Result'
      title: ListXAccountRolesResponse
      type: object
    DescribeXAccountRoleArnResponse.ResponseData:
      additionalProperties: false
      properties:
        AccountGroups:
          items:
            type: string
          title: Accountgroups
          type: array
        AccountId:
          maxLength: 12
          pattern: ^$|^[0-9]+$
          title: Accountid
          type: string
        AllowedMode:
          enum:
          - ServiceManaged
          - CustomerManaged
          title: Allowedmode
          type: string
        AvailabilityZones:
          items:
            type: string
          title: Availabilityzones
          type: array
        CloudTrailRole:
          title: Cloudtrailrole
          type: string
        DefaultRole:
          title: Defaultrole
          type: string
        Firewall:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.FirewallRoles'
        OnboardingStatus:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.AccountTableEntryStatus'
        RuleStack:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.RuleStackRoles'
        VpcInformations:
          items:
            $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.VpcDetails'
          title: Vpcinformations
          type: array
      title: ResponseData
      type: object
    DescribeXAccountRoleArnResponse.AccountTableEntryStatus:
      description: An enumeration.
      enum:
      - Success
      - Pending
      - Deleting
      - OffBoarding
      - DeleteFailed
      title: AccountTableEntryStatus
      type: string
    DescribeXAccountRoleArnResponse:
      additionalProperties: false
      properties:
        Response:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.ResponseData'
        ResponseStatus:
          $ref: '#/components/schemas/DescribeXAccountRoleArnResponse.Result'
      title: DescribeXAccountRoleArnResponse
      type: object