Palo Alto Networks Cloud Accounts API

openapi: 3.2.0
info:
  contact: {}
  description: "Access Keys are a secure way to enable programmatic access to the Prisma Cloud API. By default, only \nthe System Admin has API access and can enable API access for other administrators. If you have API access, \nyou can create up to two access keys. Create an access key for a limited time period and regenerate your API \nkeys periodically to minimize exposure and follow security best practices.\n"
  title: Prisma Cloud Access Keys API Overview Cloud Accounts API
  version: Latest
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
tags:
- description: "To begin monitoring the resources on your cloud infrastructure, you must first connect your public cloud \naccounts to Prisma™ Cloud. When you add your cloud account to Prisma Cloud, the API integration between \nyour cloud infrastructure provider and Prisma Cloud is established and you can begin monitoring the resources \nand identify potential security risks in your infrastructure.\n"
  name: Cloud Accounts
paths:
  /cloud:
    get:
      description: Lists all cloud accounts onboarded onto the Prisma Cloud platform.
      operationId: get-cloud-accounts
      parameters:
      - description: true = Exclude account group details. Default is false.
        in: query
        name: excludeAccountGroupDetails
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountViewModel'
                type: array
          description: successful operation
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Cloud Accounts
      tags:
      - Cloud Accounts
  /cloud/name:
    get:
      description: Returns a list of cloud account IDs and names.
      operationId: get-cloud-account-names
      parameters:
      - description: Returns IDs and names of active accounts only. Default is false.
        in: query
        name: onlyActive
        required: false
        schema:
          type: boolean
      - description: Returns IDs and names of accounts that belong to the specified account group IDs
        explode: true
        in: query
        name: accountGroupIds
        required: false
        schema:
          items:
            type: string
          type: array
      - description: Returns IDs and names of accounts that belong to the specified cloudType and accountGroup
        in: query
        name: cloudType
        required: false
        schema:
          type: string
      - description: Returns none cloudAccount and none cloudAccountId in response if includeOthers is true
        in: query
        name: includeOthers
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountIdentity'
                type: array
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List Cloud Account Names - GET
      tags:
      - Cloud Accounts
    post:
      description: Returns a list of cloud account IDs and names.
      operationId: get-cloud-account-names-by-post
      parameters:
      - description: Returns IDs and names of active accounts only. Default is false.
        in: query
        name: onlyActive
        required: false
        schema:
          type: boolean
      - description: Returns IDs and names of accounts that belong to the specified cloudType and accountGroup
        in: query
        name: cloudType
        required: false
        schema:
          type: string
      - description: Returns none cloudAccount and none cloudAccountId in response if includeOthers is true
        in: query
        name: includeOthers
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AccountListRequestModel'
        description: Cloud Account Groups
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountIdentity'
                type: array
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List Cloud Account Names - POST
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}/{id}/project:
    get:
      description: Lists all cloud accounts onboarded onto the Prisma Cloud platform as children of an organization.
      operationId: get-cloud-org-accounts
      parameters:
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: true = Exclude account group details. Default is false.
        in: query
        name: excludeAccountGroupDetails
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/CloudAccountViewModel'
                type: array
          description: successful operation
        '400':
          description: not_found / not_an_org
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Cloud Org Accounts
      tags:
      - Cloud Accounts
  /cloud/type:
    get:
      description: Returns all the cloud types.
      operationId: get-cloud-types
      parameters:
      - description: '**true** = return only cloud types to which the user has access and for which he has onboarded cloud accounts. Default is **false**.'
        in: query
        name: onlyAccessible
        required: false
        schema:
          type: boolean
      - description: returns other cloudType in response if includeOthers is true
        in: query
        name: includeOthers
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  type: string
                type: array
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: List Cloud Types
      tags:
      - Cloud Accounts
  /cloud/{id}/owners:
    get:
      description: Returns the email addresses of all owners for the specified cloud account ID.
      operationId: get-cloud-account-owners
      parameters:
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  type: string
                type: array
          description: successful operation
        '400':
          description: invalid_account_id_format
        '404':
          description: invalid_account_id_format
      security:
      - x-redlock-auth: []
      summary: List Cloud Account Owners
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}:
    post:
      description: "Onboard a new cloud account onto the Prisma Cloud platform.  \n\nThe request body parameters differ depending on the cloud type of the account you want to add.\n### Request Body to Add an AWS Account\nThe table below lists the request body parameters to add an AWS account.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\nenabled | boolean | Whether or not the account is enabled | Default is **false**\nexternalId | string | AWS account external ID | Required\ngroupIds | array of strings  | List of account group IDs for this account  | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\nroleArn | string | Unique identifier for an AWS resource (ARN) | Required\nprotectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is **MONITOR**\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"enabled\": true,\n  \"externalId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"roleArn\": \"\",\n  \"protectionMode\": \"MONITOR\"\n}\n```\n### Request Body to Add an AWS Org Account\nThe table below lists the request body parameters to add an AWS org account.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\nenabled | boolean | Whether or not the account is enabled | Default is **false**\nexternalId | string | AWS account external ID | Required\ngroupIds | array  | List of account group IDs for account  | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\nroleArn | string | Unique identifier for an AWS resource (ARN) | Required\naccountType | string | **organization** | Required\nmemberRoleName | string | AWS Member account role name | Required\nmemberExternalId | string | AWS Member account role's external ID | Required\nmemberRoleStatus | boolean | **true**: The member role created using stack set exists in all the member accounts. All the Org accounts will be added.<br/>**false**: Only the master account will be added. | Default is **false**\nprotectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is **MONITOR**\nhierarchySelection | array of objects | List of AWS Organization Units (OU), AWS accounts, and AWS Organizations to onboard under this organization | Default is none\nhierarchySelection.resourceId | string | Resource ID. Valid values are AWS OU ID, AWS account ID, or AWS Organization ID.<br/>Note you must escape any double quotes in the resource ID with a backslash. | Required if **hierarchySelection** is specified\nhierarchySelection.displayName | string | Display name for AWS OU, AWS account, or AWS organization | Required if **hierarchySelection** is specified\nhierarchySelection.nodeType | string | Valid values: **OU**, **ACCOUNT**, **ORG** |  Required if **hierarchySelection** is specified\nhierarchySelection.selectionType | string | Valid values: **INCLUDE** to include the specified resource to onboard, **EXCLUDE** to exclude the specified resource and onboard the rest, **ALL** to onboard all resources in the organization. |  Required if **hierarchySelection** is specified\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"enabled\": true,\n  \"externalId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"roleArn\": \"\",\n  \"accountType\": \"organization\",\n  \"memberRoleName\": \"\",\n  \"memberExternalId\": \"\",\n  \"memberRoleStatus\": true,\n  \"protectionMode\": \"MONITOR\",\n  \"hierarchySelection\": \n  [{\n    \"resourceId\": \"\",\n    \"displayName\": \"\",\n    \"nodeType\": \"OU\",\n    \"selectionType\": \"EXCLUDE\"\n  }]  \n}\n```\n\n### Request Body to Add an Azure Subscription\nThe table below lists the request body parameters to add an Azure subscription.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | Azure account ID | Required\ncloudAccount.enabled | boolean  | Whether or not to enable the account | Default is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account  | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\ncloudAccount.accountType | string | Valid value: **account** | Default is **account**\ncloudAccount.protectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs | Required\nkey | string | Application ID key | Required\nenvironmentType | string | Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"accountType\": \"account\",\n    \"protectionMode\": \"MONITOR\"\n  },\n  \"clientId\": \"\",\n  \"key\": \"\",\n  \"monitorFlowLogs\": true,\n  \"tenantId\": \"\",\n  \"servicePrincipalId\": \"\",\n  \"environmentType\": \"azure\"\n}\n```\n\n### Request Body to Add an Azure Tenant\nThe table below lists the request body parameters to add an Azure tenant without management groups.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | **cloudAccount.accountId** should be \"\" (empty)| Must be empty\ncloudAccount.enabled | boolean  | Whether or not to enable the account | Default is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account  | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.accountType | string | Valid value: **tenant** | Required\ncloudAccount.protectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is **MONITOR_AND_PROTECT**\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs | Required\nkey | string | Application ID key | Required\nenvironmentType | string | Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"accountType\": \"tenant\",\n    \"protectionMode\": \"MONITOR\"\n  },\n  \"clientId\": \"\",\n  \"key\": \"\",\n  \"monitorFlowLogs\": true,\n  \"tenantId\": \"\",\n  \"servicePrincipalId\": \"\",\n  \"environmentType\": \"azure\"\n}\n```\n\n### Request Body to Add an Azure Tenant with Management Groups\nThe table below lists the request body parameters to add an Azure tenant plus management groups and subscriptions \nassociated with that tenant.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | Must be set to \"\" (empty)| Must be empty\ncloudAccount.enabled | boolean  | Whether or not to enable the account | Default is **false**\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.accountType | string | Valid value: **tenant** | Required\ncloudAccount.protectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Default is **MONITOR_AND_PROTECT**\nclientId | string | Application ID registered with Active Directory | Required\ntenantId | string | Active Directory ID associated with Azure | Required\nservicePrincipalId | string | Unique ID of the service principal object associated with the Prisma Cloud application | Required\nmonitorFlowLogs | boolean | Automatically ingest flow logs | Required\nkey | string | Application ID key | Required\nenvironmentType | string | Valid values:<br/>**azure** (Commercial),<br/>**azure_gov** (Government),<br/>**azure_china** (China) | Required\ndefaultAccountGroupId | string | Account group ID for this tenant. Used for alert rules. | Required\nrootSyncEnabled | boolean | **true** = Azure tenant has children. Must be set to **true**. | Required\nhierarchySelection | array of objects | List of subscriptions and/or management groups to onboard | Default is none\nhierarchySelection.resourceId | string | Management group ID or subscription ID.<br/>Note you must escape any double quotes in the resource ID with a backslash. | Required if **hierarchySelection** is specified\nhierarchySelection.displayName | string | Display name for management group or subscription | Required if **hierarchySelection** is specified\nhierarchySelection.nodeType | string | Valid values: **SUBSCRIPTION**, **TENANT**, **MANAGEMENT_GROUP** | Required if **hierarchySelection** is specified\nhierarchySelection.selectionType | string | Valid values: **INCLUDE** to include the specified resource to onboard, **EXCLUDE** to exclude the specified resource and onboard the rest, **ALL** to onboard all resources in the tenant. |  Required if **hierarchySelection** is specified      \n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"enabled\": true,\n    \"name\": \"\",\n    \"accountType\": \"tenant\",\n    \"protectionMode\": \"MONITOR_AND_PROTECT\"\n  },\n  \"clientId\": \"\",\n  \"key\": \"\",\n  \"monitorFlowLogs\": true,\n  \"tenantId\": \"\",\n  \"servicePrincipalId\": \"\",\n  \"environmentType\": \"azure\",\n  \"defaultAccountGroupId\": \"\",\n  \"rootSyncEnabled\": true,\n  \"hierarchySelection\":[{\n    \"displayName\":\"Tenant Root Group\",\n    \"nodeType\":\"TENANT\",\n    \"resourceId\":\"\",\n    \"selectionType\":\"INCLUDE\"\n  }]\n}\n```        \n\n### Request Body to Add a GCP Project\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | GCP project ID | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.enabled | boolean  | Whether or not the account is enabled | Defaults is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account | Required\ncloudAccount.projectId | string  | Existing GCP project ID | Required\ncloudAccount.protectionMode | string  | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required \ncloudAccount.accountType | string | Valid value: **account** | Required\ncredentials | JSON object | Service account key | Required\ncompressionEnabled |boolean | Enable flow log compression | Default is **false**\ndataflowEnabledProject | string | GCP project for flow log compression | Required if **compressionEnabled** is **true**\nflowLogStorageBucket | string | GCP flow logs storage bucket | Default is \"\"\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"accountType\": \"account\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"projectId\":\"\",\n    \"protectionMode\": \"MONITOR\"\n},\n\"compressionEnabled\": true,\n\"dataflowEnabledProject\": \"\",\n\"flowLogStorageBucket\": \"\",\n\"credentials\": {\n  \"type\": \"\",\n  \"project_id\": \"\",\n  \"private_key_id\": \"\",\n  \"private_key\": \"\",\n  \"client_email\": \"\",\n  \"client_id\": \"\",\n  \"auth_uri\": \"\",\n  \"token_uri\": \"\",\n  \"auth_provider_x509_cert_url\": \"\",\n  \"client_x509_cert_url\": \"\"\n}\n```\n\n### Request Body to Add a GCP Org\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | GCP Org ID | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.enabled | boolean  | Whether or not the account is enabled | Default is **false**\ncloudAccount.protectionMode | string  | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required \ncloudAccount.accountType | string | Valid value: **organization** | Required\ncredentials | JSON object | Service account key | Required\ncompressionEnabled |boolean | Enable flow log compression | Default is **false**\ndataflowEnabledProject | string | GCP project for flow log compression | Required if **compressionEnabled** is **true**\nflowLogStorageBucket | string | GCP flow logs storage bucket | Default is \"\"\norganizationName | string | GCP organization name | Required \naccountGroupCreationMode | string | Cloud account group creation mode. Valid values:<br/>**MANUAL**: Create account groups manually<br/>**AUTO**: Create high-level account groups based on folders identified<br/>**RECURSIVE**: Drill down in folder tree to create account groups | Default is **MANUAL**\ndefaultAccountGroupId | string | Account group ID for this account. Used for alert rules. | Required if **accountGroupCreationMode** is **MANUAL** \nhierarchySelection | array of objects | List of folders and/or projects to onboard under this organization | Default is none\nhierarchySelection.resourceId | string | Resource ID. For folders, format is _folders/{folder ID}_. For projects, format is _{project number}_. For orgs, format is _organizations/{org ID}_ | Required if **hierarchySelection** is specified\nhierarchySelection.displayName | string | Display name for folder, project, or organization | Required if **hierarchySelection** is specified\nhierarchySelection.nodeType | string | Valid values: **FOLDER**, **PROJECT**, **ORG** |  Required if **hierarchySelection** is specified\nhierarchySelection.selectionType | string | Valid values: **INCLUDE**, **EXCLUDE**, **INCLUDE ALL**. If **hierarchySelection.nodeType** is **PROJECT** or **FOLDER**, valid values are  **INCLUDE**, **EXCLUDE**. |  Required if **hierarchySelection** is specified\n\n#### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"accountType\": \"organization\",\n    \"proectionMode\": \"MONITOR\"\n    \"enabled\": true,       \n    \"name\": \"\"\n},\n\"accountGroupCreationMode\": \"MANUAL\"\n\"compressionEnabled\": true,\n\"dataflowEnabledProject\": \"\",\n\"flowLogStorageBucket\": \"\",\n\"organizationName\": \"\",\n\"defaultAccountGroupId\": \"\",\n\"credentials\": {\n  \"type\": \"\",\n  \"project_id\": \"\",\n  \"private_key_id\": \"\",\n  \"private_key\": \"\",\n  \"client_email\": \"\",\n   \"client_id\": \"\",\n  \"auth_uri\": \"\",\n  \"token_uri\": \"\",\n  \"auth_provider_x509_cert_url\": \"\",\n  \"client_x509_cert_url\": \"\"\n},\n\"hierarchySelection\": \n  [{\n    \"resourceId\": \"\",\n    \"displayName\": \"\",\n    \"nodeType\": \"FOLDER\",\n    \"selectionType\": \"EXCLUDE\"\n  }]    \n}\n```\n\n### Request Body to Add a GCP Master Service Account\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\ncloudAccount.accountId | string | GCP project ID | Required\ncloudAccount.name | string | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\ncloudAccount.enabled | boolean  | Whether or not the account is enabled | Default is **false**\ncloudAccount.groupIds | array of strings | List of account group IDs for this account | Required\ncloudAccount.projectId | string  | Existing GCP project ID | Required\ncloudAccount.protectionMode | string  | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required \ncloudAccount.accountType | string | Valid value: **masterServiceAccount** | Required\ndefaultAccountGroupId | string | Account group ID for this account. Used for alert rules. |  Required \ncredentials | JSON object | Service account key | Required\ncompressionEnabled |boolean | Enable flow log compression | Default is **false**\ndataflowEnabledProject | string | GCP project for flow log compression | Required if **compressionEnabled** is **true**\nflowLogStorageBucket | string | GCP flow logs storage bucket | Default is \"\"\n\n##### Request Body Example\n```json\n{\n  \"cloudAccount\": {\n    \"accountId\": \"\",\n    \"accountType\": \"masterServiceAccount\",\n    \"enabled\": true,\n    \"groupIds\": [],\n    \"name\": \"\",\n    \"projectId\":\"\",\n    \"protectionMode\": \"MONITOR\"\n},\n\"compressionEnabled\": true,\n\"dataflowEnabledProject\": \"\",\n\"flowLogStorageBucket\": \"\",\n\"organizationName\": \"\",\n\"credentials\": {\n  \"type\": \"\",\n  \"project_id\": \"\",\n  \"private_key_id\": \"\",\n  \"private_key\": \"\",\n  \"client_email\": \"\",\n  \"client_id\": \"\",\n   \"auth_uri\": \"\",\n  \"token_uri\": \"\",\n  \"auth_provider_x509_cert_url\": \"\",\n  \"client_x509_cert_url\": \"\"\n}\n```\n\n### Request Body to Add an Alibaba Account\nThe table below lists the request body parameters to add an Alibaba account.\n\nParameter  | Type | Description | Default Value or Required\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\ngroupIds | array of strings  | List of account group IDs for this account  | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\nroleArn | string | Unique identifier for an Alibaba RAM role resource | Required\nenabled | boolean | Whether or not the account is enabled | Default is **false**\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"enabled\": true,\n  \"ramArn\": \"\"\n}\n```\n### Requirements and Request Body to Add an OCI Account\nTo add an Oracle Cloud Infrastructure (OCI) account, you must:\n\n1. Use [Generate Zipped Terraform Script (OCI)](/prisma-cloud/api/cspm/generateterraformscript) in the console | Required\n\n#### Request Body Example\n```json\n{\n  \"accountType\":\"tenant\",\n  \"defaultAccountGroupId\":\"\",\n  \"enabled\":true,\n  \"name\":\"\",\n  \"groupName\":\"\",\n  \"homeRegion\":\"\",\n  \"policyName\":\"\",\n  \"accountId\":\"\",\n  \"userName\":\"\",\n  \"userOcid\":\"\"\n}\n```\n"
      operationId: add-cloud-account
      parameters:
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      - description: true = Skip account status checks to improve response time
        in: query
        name: skipStatusChecks
        required: false
        schema:
          type: boolean
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties:
                type: object
              type: object
        description: Cloud Account
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: duplicate_cloud_account_name / duplicate_cloud_account / invalid_account_id_format / duplicate_cloud_account_needs_upgrade / cannot_select_zero_account_groups / invalid_account_group_ids
        '404':
          description: invalid_account_type
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Add Cloud Account
      tags:
      - Cloud Accounts
  /cloud/oci/terraform:
    post:
      description: Generates a zipped Terraform template to help you onboard your Oracle Cloud Infrastructure account to Prisma Cloud. You can use this template in the OCI Tenant Console to get a User OCID. Note that the generated keys will be valid for 24 hours.
      operationId: generateterraformscript
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/TerraformProvisionerRequest'
      responses:
        '200':
          description: successful operation
        '400':
          description: invalid_parameter_value
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Generate Zipped Terraform Script (OCI)
      tags:
      - Cloud Accounts
  /cloud/{cloud_type}/{id}:
    get:
      description: Returns top level information about the cloud account.
      operationId: get-cloud-account
      parameters:
      - description: Cloud Type
        in: path
        name: cloud_type
        required: true
        schema:
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
      - description: Account ID
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: true = Include account group info. Default is false.
        in: query
        name: includeGroupInfo
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/CloudAccountModel'
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: Cloud Account Info
      tags:
      - Cloud Accounts
    put:
      description: "Update information related to a cloud account.  \n\nThe request body parameters differ depending on the cloud type of the account you want to add.\n### Request Body to Update an AWS Account\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Required?\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\nenabled | boolean | Whether or not the account is enabled | Required\nexternalId | string | AWS account external ID | Required\ngroupIds | array of strings | List of account group IDs for this account  | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique)  | Required\nroleArn | string | Unique identifier for an AWS resource (ARN) | Required\nprotectionMode |string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required\n\n#### Request Body Example\n```json\n{\n  \"accountId\": \"\",\n  \"enabled\": true,\n  \"externalId\": \"\",\n  \"groupIds\": [],\n  \"name\": \"\",\n  \"roleArn\": \"\",\n  \"protectionMode\": \"MONITOR\"\n}\n```\n### Request Body to Update an AWS Org Account\nThe table below lists the request body parameters.\n\nParameter  | Type | Description | Required?\n-----------| ---- | ----------- | -------------\naccountId | string | AWS account ID | Required\nenabled | boolean | Whether or not the account is enabled | Required\nexternalId | string | AWS account external ID | Required\ngroupIds | array of strings  | List of account group IDs for this account | Required\nname | string  | Name to be used for the account on the Prisma Cloud platform (must be unique) | Required\nroleArn | string | Unique identifier for an AWS resource (ARN) | Required\naccountType | string | **organization** | Required\nmemberRoleName | string | AWS Member account role name | Required\nmemberExternalId | string | AWS Member account role's external ID | Required\nmemberRoleStatus | boolean | **true**: The member role created using stack set exists in all the member accounts. All the Org accounts will be added.<br/>**false**: Only the master account will be added. | Required\nprotectionMode | string | Valid values: **MONITOR**, **MONITOR_AND_PROTECT** | Required\nhierarchySelection | array of objects | List of AWS Organization Units (OU), AWS accounts, and AWS Organizations to onboard under this organization | Default is none\nhierarchySelection.resourceId | string | Resource ID. Valid values are AWS OU ID, AWS account ID, or AWS Organization ID.<br/>Note you must escape any double quotes in the resource ID with 

# --- truncated at 32 KB (138 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-cloud-accounts-api-openapi.yml