Palo Alto Networks

Palo Alto Networks Cloud Accounts (AWS) API

To monitor the resources on your AWS cloud infrastructure, you must first add your AWS accounts to Prisma Cloud. When you add your cloud account to Prisma Cloud, the API integration between AWS and Prisma Cloud is established and you can begin monitoring the resources and identify potential security risks. The Cloud Account (AWS) APIs enable you to add and manage AWS accounts on Prisma Cloud. For end to end workflow to onboarding an AWS account using APIs, see [Automate AWS Cloud Account Onboarding](/prisma-cloud/docs/cspm/aws-cloud-account-onboarding/). For common operations related to cloud accounts, see [Cloud Accounts (All)](/prisma-cloud/api/cspm/cloud-accounts-all/).

GitHub OpenAPI

Operations 11

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /cas/v1/aws_account Onboard an AWS cloud account · Add Cloud Account (AWS) #
Ask an LLM
“How do I onboard an AWS account into Prisma Cloud using an IAM role ARN?”
“Can I onboard a whole AWS organization rather than a single account?”
Tell an agent
Onboard AWS account {accountId} as {name} using role {roleArn}, account type {accountType}.
Add AWS {accountType} account {accountId} named {name} with role {roleArn} into account groups {groupIds}.
POST /cas/v1/aws_account/{account_id}/ancestors List ancestors of AWS member accounts and OUs · List Ancestors (AWS) #
Ask an LLM
“Which parent OUs sit above certain member accounts in my onboarded AWS organization?”
“Can I map a list of AWS account and OU IDs to their ancestor chain?”
Tell an agent
List the ancestors of resources {resourceIds} in AWS org account {account_id}, with AWS account {accountId}, role {roleArn}, type {accountType}.
Find parent OUs for {resourceIds} under cloud account {account_id} (AWS ID {accountId}, role {roleArn}, {accountType}).
PUT /cas/v1/aws_account/{id} Update an onboarded AWS cloud account · Update Cloud Account (AWS) #
Ask an LLM
“How do I change the role ARN or features on an AWS account already in Prisma Cloud?”
“Can I move an onboarded AWS account into different account groups?”
Tell an agent
Update AWS cloud account {id}: AWS ID {accountId}, name {name}, role {roleArn}, type {accountType}.
Reassign onboarded AWS account {id} ({accountId}, {name}, role {roleArn}, {accountType}) to groups {groupIds}.
POST /cas/v1/aws_account/{parent_id}/children List child OUs and accounts under an AWS parent · List Children of Parent (AWS) #
Ask an LLM
“What accounts and OUs live directly under a given organizational unit in my AWS organization?”
“Can I page through child accounts and child OUs separately?”
Tell an agent
List children of AWS OU {parent_id} for account {accountId} with role {roleArn} and type {accountType}.
Get {accountFetchCount} child accounts under OU {parent_id} (AWS {accountId}, role {roleArn}, {accountType}).
POST /cas/v1/cloud_account/status/aws Check the status of an AWS cloud account · Get Cloud Account Status (AWS) #
Ask an LLM
“Why is my AWS account showing errors in Prisma Cloud — what do its status messages say?”
“Can I validate an AWS account's role and permissions before onboarding it?”
Tell an agent
Check status of AWS account {accountId} named {name} with role {roleArn}, type {accountType}.
Show status messages for AWS {accountType} account {accountId} ({name}) using role {roleArn}.
POST /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{account_id}/ancestors List AWS ancestors via the legacy endpoint · List Ancestors (AWS) - Legacy #
Ask an LLM
“Is there an older cloud-accounts-manager endpoint for finding the ancestors of AWS member accounts?”
“Can I get ancestors for an AWS account with the legacy call that needs only the account ID?”
Tell an agent
Using the legacy cloud accounts manager, list ancestors for AWS account {account_id}.
Call the legacy AWS ancestors endpoint for cloud account {account_id}.
POST /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{parent_id}/children List AWS OU children via the legacy endpoint · List Children of Parent (AWS) - Legacy #
Ask an LLM
“Is there a legacy call to list child accounts and OUs under an AWS parent without sending credentials in the body?”
“Can the older children endpoint page OUs with its own token?”
Tell an agent
Using the legacy cloud accounts manager, list children of OU {parent_id}.
Get {ouFetchCount} child OUs of {parent_id} from the legacy children endpoint.
POST /cas/v1/aws_template Download the AWS onboarding CFT template · Generate and Download the CFT Template (AWS) #
Ask an LLM
“Where can I download the CloudFormation template file that creates the Prisma Cloud IAM role?”
“Does the downloadable CFT include the generated external ID?”
Tell an agent
Download the CFT template file for AWS account {accountId}, type {accountType}.
Generate a {cftType} CFT template body for {accountType} account {accountId}.
GET /config/v3/account/awsorg/{id} Get AWS Org master account details for PCDS · Fetch Master Account Details (AWS Org) #
Ask an LLM
“What attributes define my AWS organization master account for data security flows?”
“Can I fetch the PCDS configuration of an AWS Org account?”
Tell an agent
Fetch the AWS Org master account details for {id}.
Show the PCDS config of AWS organization account {id}.
GET /config/v3/account/awsorg/{id}/status Check PCDS permissions on an AWS Org account · Performs a Permissions Check for the Given PCDS Account (AWS Org) #
Ask an LLM
“Is my AWS Org account missing any permissions needed for data security scanning?”
“Can I run a permissions check on a PCDS AWS organization account?”
Tell an agent
Run the PCDS permissions check on AWS Org account {id}.
List missing permissions for AWS organization account {id}.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-cloud-accounts-aws-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-cloud-accounts-aws-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-cloud-accounts-aws-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks Cloud Accounts (AWS) API
  version: '1.0'
  description: 'Operations tagged Cloud Accounts (AWS) across 3 of this provider''s published API definitions: palo-alto-cspm-cloudaccountonboardingmicroservices-openapi.json, palo-alto-cspm-cloudaccountsmicroservice-openapi.json, palo-alto-cspm-datasecurityonboardingmicroservice-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:


# --- truncated at 32 KB (40 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-cloud-accounts-aws-api-openapi.yml