Palo Alto Networks

Palo Alto Networks Cloud Accounts API

To begin monitoring the resources on your cloud infrastructure, you must first connect your public cloud accounts to Prisma™ Cloud. When you add your cloud account to Prisma Cloud, the API integration between your cloud infrastructure provider and Prisma Cloud is established and you can begin monitoring the resources and identify potential security risks in your infrastructure.

GitHub OpenAPI

Operations 35

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /cloud List all onboarded cloud accounts · List Cloud Accounts #
Ask an LLM
“Which cloud accounts are onboarded to Prisma Cloud right now?”
“Can I list my cloud accounts without the account group details attached?”
Tell an agent
List every cloud account onboarded to Prisma Cloud.
Show all onboarded cloud accounts, excluding account group details: {exclude}.
GET /cloud/name Get cloud account IDs and names · List Cloud Account Names - GET #
Ask an LLM
“What are the IDs and names of my active cloud accounts?”
“Can I get just account names for one cloud type using a simple GET lookup?”
Tell an agent
Get the IDs and names of only active cloud accounts.
Look up account names and IDs for cloud type {cloudType} via the GET name list.
POST /cloud/name Look up cloud account names with a filter body · List Cloud Account Names - POST #
Ask an LLM
“Can I filter cloud account names by a time range and a filter key in a POST body?”
“Is there a way to get cloud account names grouped by a field for specific account IDs?”
Tell an agent
Post a cloud account name lookup for time range {timeRange}.
Fetch account names for account IDs {accountIds} within {timeRange}, grouped by {groupBy}.
GET /cloud/{cloud_type}/{id}/project List member accounts under a cloud organization · List Cloud Org Accounts #
Ask an LLM
“Which child accounts or projects sit under my onboarded cloud organization?”
“Can I see all the member accounts onboarded as children of one org account?”
Tell an agent
List the child accounts of {cloud_type} organization {id}.
Show the projects onboarded under org account {id} on {cloud_type} without group details.
GET /cloud/type List supported cloud types · List Cloud Types #
Ask an LLM
“What cloud types does Prisma Cloud support?”
“Which cloud types do I personally have access to?”
Tell an agent
List all cloud types.
Show only the cloud types I can access.
GET /cloud/{id}/owners List owner emails for a cloud account · List Cloud Account Owners #
Ask an LLM
“Who owns this cloud account?”
“Where can I find the owner email addresses for an onboarded account?”
Tell an agent
Get the owner email addresses for cloud account {id}.
Tell me who owns account {id}.
POST /cloud/{cloud_type} Onboard a cloud account by cloud type · Add Cloud Account #
Ask an LLM
“How do I onboard a new Azure, GCP or Alibaba account into Prisma Cloud?”
“Can I skip the account status checks to speed up onboarding a cloud account?”
Tell an agent
Onboard a new {cloud_type} cloud account.
Add a {cloud_type} account and skip status checks.
POST /cloud/oci/terraform Generate an OCI onboarding Terraform script · Generate Zipped Terraform Script (OCI) #
Ask an LLM
“How do I get a Terraform template to onboard my Oracle Cloud tenancy?”
“Can the OCI onboarding script also generate keys, and how long do they last?”
Tell an agent
Generate the OCI Terraform zip for tenancy {accountId} with user {userName}, group {groupName} and policy {policyName}.
Create an OCI onboarding script with generated keys for tenancy {accountId}.
GET /cloud/{cloud_type}/{id} Get details of one cloud account · Cloud Account Info #
Ask an LLM
“What top-level details does Prisma Cloud hold for a specific cloud account?”
“Can I see which account groups a given cloud account belongs to?”
Tell an agent
Get info for {cloud_type} account {id}.
Show {cloud_type} account {id} including its account group info.
PUT /cloud/{cloud_type}/{id} Update a cloud account by cloud type · Update Cloud Account #
Ask an LLM
“How do I change the onboarding settings of an existing non-AWS cloud account?”
“Can I update a cloud account's configuration without waiting for status checks?”
Tell an agent
Update the configuration of {cloud_type} account {id}.
Save changes to {cloud_type} account {id} and skip status checks.
DELETE /cloud/{cloud_type}/{id} Remove an onboarded cloud account · Delete Cloud Account #
Ask an LLM
“How do I offboard a cloud account from Prisma Cloud?”
“What happens if I delete a cloud account that's been onboarded?”
Tell an agent destructive · confirm first
Delete {cloud_type} account {id}.
Offboard cloud account {id} of type {cloud_type}.
PATCH /cloud/{cloud_type}/{id} Update a cloud account’s settings · Patch Cloud Account #
Ask an LLM
“Can I change the account groups on an onboarded cloud account or switch it off?”
“Is it possible to update child account status along with the parent account?”
Tell an agent
Move {cloud_type} account {id} into account groups {groupIds}.
Set enabled to {enabled} on {cloud_type} account {id} and apply it to child accounts with {updateChildrenStatus}.
GET /account/{accountId}/config/status Show services with warnings for an account · List Account Status Details #
Ask an LLM
“Which Prisma Cloud services are showing warnings or errors for my account?”
“Why is my cloud account in an error state?”
Tell an agent
List the services with warning or error status for account {accountId}.
Show the config status details of cloud account {accountId}.
POST /cloud/status/{cloud_type} Dry-run onboarding checks for a cloud type · Get Cloud Account Status #
Ask an LLM
“Can I validate my onboarding parameters before actually adding an account?”
“How do I run a trial onboarding for an Azure or GCP account?”
Tell an agent
Run an onboarding trial for a {cloud_type} account.
Validate my {cloud_type} account parameters before onboarding.
PATCH /cloud/{id}/status/{enabled} Enable or disable a cloud account · Update Cloud Account Status #
Ask an LLM
“What's the quickest way to turn monitoring off for one cloud account?”
“Can I re-enable an account and its children just by setting a status flag?”
Tell an agent
Set the status of cloud account {id} to {enabled}.
Disable account {id} by setting enabled to {enabled} and apply to children.
GET /cloud/{cloud_type}/accounts/{account_id}/hierarchy Get the saved GCP resource hierarchy · Get Saved Resource Hierarchy (GCP) #
Ask an LLM
“Where can I see the GCP folder and project hierarchy I saved earlier?”
“What resource hierarchy was stored for my GCP org account?”
Tell an agent
Get the saved resource hierarchy for GCP account {account_id} of type {cloud_type}.
Show the previously saved hierarchy of {cloud_type} account {account_id}.
POST /cloud/gcp/parent/{parent_id}/children List GCP folders and projects under a parent · List Children of Parent (GCP) #
Ask an LLM
“How can I see both folders and projects beneath a GCP organization?”
“Can I page through GCP projects and folders under a parent separately?”
Tell an agent
List the folders and projects under GCP parent {parent_id} of type {parentType}.
Get all children of GCP {parentType} {parent_id} using my service account key {credentials}.
POST /cloud/{cloud_type}/parent/{parent_id}/folders List GCP child folders of a parent · List Folders of Parent (GCP) #
Ask an LLM
“Which GCP folders sit directly under my organization or folder?”
“Can I list only the folders, not projects, under a GCP parent?”
Tell an agent
List only the child folders of GCP {parentType} {parent_id} for {cloud_type}.
Page through GCP folders under {parent_id} with page size {pageSize}; parent type {parentType}, cloud {cloud_type}.
POST /cloud/{cloud_type}/parent/{parent_id}/projects List GCP child projects of a parent · List Projects of Parent (GCP) #
Ask an LLM
“What GCP projects live under a given folder?”
“Can I list only the projects, skipping folders, beneath a GCP org?”
Tell an agent
List the child projects of GCP {parentType} {parent_id} for {cloud_type}.
Page GCP projects under {parent_id} with page size {pageSize}; parent type {parentType}, cloud {cloud_type}.
POST /cloud/{cloud_type}/accounts/{account_id}/ancestors Find ancestors of GCP projects and folders · List Ancestors (GCP) #
Ask an LLM
“Which parent folders and org does a given GCP project roll up to?”
“Can I map several GCP projects to their ancestor chain at once?”
Tell an agent
Get the GCP ancestors of resources {resourceIds} in {cloud_type} account {account_id}.
Show the ancestor chain for GCP projects in account {account_id} of type {cloud_type}.
POST /cloud-accounts-manager/v1/cloudAccounts/azureAccounts/{parent_id}/children List Azure subscriptions and groups under a parent · List Children of Parent (Azure) #
Ask an LLM
“What subscriptions and management groups are under my Azure tenant?”
“Can I browse the children of an Azure management group?”
Tell an agent
List Azure subscriptions and management groups under parent {parent_id}.
Show the children of Azure management group {parent_id}.
POST /cloud-accounts-manager/v1/cloudAccounts/azureAccounts/{account_id}/ancestors Find ancestors of Azure subscriptions · List Ancestors (Azure) #
Ask an LLM
“Which management groups does an Azure subscription roll up to?”
“Can I get the ancestor path for several Azure subscriptions at once?”
Tell an agent
Get the Azure ancestors of {resourceIds} in tenant account {account_id}.
Show the management group ancestry for Azure tenant {account_id}.
POST /dlp/api/v1/config/awsorg/status Check AWS org data security prerequisites · Check Data Security Preconditions (AWS Org) #
Ask an LLM
“Does my AWS Organization meet the prerequisites for data security scanning?”
“What does Prisma Cloud check before I can set up data security for an AWS org?”
Tell an agent
Check data security preconditions for AWS org {accountId} with role {roleArn}, external ID {externalId} and SNS topic {snsTopicArn}.
Verify AWS org {accountId} is ready for a data security config.
POST /dlp/api/config/v2 Create a data security config for an AWS org · Add Data Security Config (AWS Org) #
Ask an LLM
“How do I turn on data security scanning for my whole AWS Organization?”
“What do I need, like role ARNs and an SNS topic, to create an AWS org data security config?”
Tell an agent
Create a data security config for AWS org {accountId} with master role {masterRoleArn} and SNS topic {snsTopicArn}.
Start data security scanning on AWS org {accountId} with scan option {scanOption}.
PUT /dlp/api/config/v2 Update data security config for an AWS org · Update Data Security Config (AWS Org) #
Ask an LLM
“How do I change the scan option on an existing AWS org data security config?”
“Can I rotate the member role name used by an AWS org data security scan?”
Tell an agent
Update the AWS org data security config for {accountId} to scan option {scanOption}.
Change the existing data security scan of AWS org {accountId} to use member role {memberRoleName}.
GET /dlp/api/config/v2/{accountId} Get the data security config of an AWS org · Get Data Security Config (AWS Org) #
Ask an LLM
“What data security scan settings are configured for my AWS org?”
“Is data security already configured for this AWS Organization?”
Tell an agent
Get the data security config for AWS org {accountId}.
Show the scan settings on AWS org account {accountId}.
POST /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{parent_id}/children List AWS OU children (legacy endpoint) · List Children of Parent (AWS) - Legacy #
Ask an LLM
“Is there still a legacy endpoint to list accounts and OUs under an AWS organizational unit?”
“Can I page AWS child accounts under an OU using the older cloud accounts manager path?”
Tell an agent
Using the legacy endpoint, list the accounts and OUs under AWS OU {parent_id}.
Legacy lookup: fetch {accountFetchCount} child accounts of AWS OU {parent_id}.
POST /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{account_id}/ancestors Find AWS account ancestors (legacy endpoint) · List Ancestors (AWS) - Legacy #
Ask an LLM
“Does the older cloud accounts manager API still return ancestors for AWS member accounts?”
“Where's the legacy call that maps AWS OUs to their parents?”
Tell an agent
Using the legacy endpoint, get ancestors of members in AWS account {account_id}.
Legacy lookup: show the OU ancestry for AWS org account {account_id}.
POST /cas/v1/aws_account Onboard an AWS account · Add AWS Cloud Account #
Ask an LLM
“How do I onboard an AWS account or organization using a role ARN?”
“Can I choose which features to enable when adding an AWS account?”
Tell an agent
Onboard AWS account {accountId} named {name} with role {roleArn} as type {accountType}.
Add AWS organization {accountId} as {name} using role {roleArn} into account group {defaultAccountGroupId}; type {accountType}.
PUT /cas/v1/aws_account/{id} Update an onboarded AWS account · Update AWS Cloud Account #
Ask an LLM
“How do I change the role ARN or features of an AWS account already onboarded?”
“Can I rename an existing AWS cloud account?”
Tell an agent
Update AWS cloud account {id} with new role {roleArn}; AWS ID {accountId}, name {name}, type {accountType}.
Rename AWS cloud account {id} to {name}.
POST /cas/v1/cloud_account/status/aws Check an AWS account onboarding status · Get AWS Cloud Account Status #
Ask an LLM
“Will my AWS role ARN and settings pass Prisma Cloud's account checks?”
“What status messages come back for an AWS account before or after onboarding?”
Tell an agent
Check the AWS status messages for account {accountId} with role {roleArn}; name {name}, type {accountType}.
Validate AWS account {accountId} permissions.
POST /cas/v1/aws_account/{parent_id}/children List AWS accounts and OUs under an OU · List Children of Parent (AWS) #
Ask an LLM
“Which AWS accounts and organizational units are under a given OU?”
“Can I browse my AWS org tree one OU at a time?”
Tell an agent
List the AWS accounts and OUs under OU {parent_id} for org {accountId} with role {roleArn}, type {accountType}.
Show the child OUs of AWS OU {parent_id}.
POST /cas/v1/aws_account/{account_id}/ancestors Find ancestors of AWS accounts and OUs · List Ancestors (AWS) #
Ask an LLM
“Which OUs does an AWS member account sit under?”
“Can I get the parent chain for several AWS accounts in one request?”
Tell an agent
Get the ancestors of AWS resources {resourceIds} in org account {account_id}.
Map AWS accounts {resourceIds} to their OU ancestry using role {roleArn} for {accountId}, type {accountType}.
POST /cloud/{cloudType} Onboard a named cloud account with account groups · Palo Alto Networks Add a Cloud Account #
Ask an LLM
“What do I need to supply, like the provider account ID and a display name, to start monitoring an AWS or OCI account?”
“Can I attach account groups to a cloud account at the moment I onboard it?”
Tell an agent
Onboard {cloudType} account {accountId} under the display name {name}.
Start monitoring {cloudType} account {accountId} as {name} and put it in account groups {groupIds}.
DELETE /cloud/{cloudType}/{id} Stop monitoring a cloud account, keeping its alerts · Palo Alto Networks Remove a Cloud Account #
Ask an LLM
“How can I stop Prisma Cloud monitoring an account but keep its old alerts for historical analysis?”
“Are alerts and data kept after a cloud account is removed from monitoring?”
Tell an agent destructive · confirm first
Remove {cloudType} account {id} from monitoring but keep its alert history.
Stop monitoring cloud account {id} ({cloudType}) and retain its historical data.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-cloud-accounts-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-cloud-accounts-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-cloud-accounts-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact: {}
  description: 'Access Keys are a secure way to enable programmatic access to the Prisma Cloud API. By default, only

    the System Admin has API access and can enable API access for other administrators. If you have API access,

    you can create up to two access keys. Create an access key for a limited time period and regenerate your API

    keys periodically to minimize exposure and follow security best practices.'
  title: Prisma Cloud Access Keys API Overview Cloud Accounts API
  version: Latest
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
tags:


# --- truncated at 32 KB (105 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-cloud-accounts-api-openapi.yml