Palo Alto Networks Cloud Accounts (AWS) API

openapi: 3.2.0
info:
  title: Palo Alto Networks Cloud Accounts (AWS) API
  version: '1.0'
  description: 'Operations tagged Cloud Accounts (AWS) across 4 of this provider''s published API definitions: palo-alto-cspm-cloudaccountonboardingmicroservices-openapi.json, palo-alto-cspm-cloudaccounts-aws-openapi.json, palo-alto-cspm-cloudaccountsmicroservice-openapi.json, palo-alto-cspm-datasecurityonboardingmicroservice-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- name: Cloud Accounts (AWS)
  description: "To monitor the resources on your AWS cloud infrastructure, you must first add your AWS accounts to Prisma Cloud. When you add your cloud account to Prisma Cloud, the API integration between AWS and Prisma Cloud is established and you can begin monitoring the resources and identify potential security risks.\n\nThe Cloud Account (AWS) APIs enable you to add and manage AWS accounts on Prisma Cloud. For end to end workflow to onboarding an AWS account using APIs, see [Automate AWS Cloud Account Onboarding](/prisma-cloud/docs/cspm/aws-cloud-account-onboarding/).\n For common operations related to cloud accounts, see [Cloud Accounts (All)](/prisma-cloud/api/cspm/cloud-accounts-all/).\n"
paths:
  /cas/v1/aws_account:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: Add Cloud Account (AWS)
      description: "Onboard a new aws cloud account onto the Prisma Cloud platform.\n\n **Prerequisite**: Generate the externalId and AWS CFT template by calling either **[Generate and Download the CFT Template Endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**"
      operationId: add-aws-cloud-account
      parameters:
      - name: skipStatusChecks
        in: query
        description: true = Skip account status checks to improve response time
        required: false
        schema:
          type: boolean
      requestBody:
        $ref: '#/components/requestBodies/AwsCloudAccountRequestModel2'
      responses:
        '200':
          description: successful operation
        '400':
          description: duplicate_cloud_account_name / duplicate_cloud_account / duplicate_cloud_account_needs_upgrade / cannot_select_zero_account_groups / invalid_account_group_ids / invalid_account_type
        '404':
          description: invalid_account_id_format
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_account/{account_id}/ancestors:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: List Ancestors (AWS)
      description: Lists the ancestors of the given member accounts and organizational units (OUs) for the specified cloud account ID. A successful response returns an array of accounts and/or OUs each of which is mapped to an array of ancestor resource IDs.
      operationId: get-ancestors-for-given-members-ous
      parameters:
      - name: account_id
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsOrgAncestorRequestModel'
        description: Cloud Account JSON
        required: true
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AwsNodeModel'
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_account/{id}:
    put:
      tags:
      - Cloud Accounts (AWS)
      summary: Update Cloud Account (AWS)
      description: Update details of an AWS cloud account that is already present in Prisma Cloud. **Note:** To enable or disable a cloud account, use [Update Cloud Account Status](https://pan.dev/prisma-cloud/api/cspm/update-cloud-account-status/) API.
      operationId: update-aws-cloud-account
      parameters:
      - name: id
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      - name: skipStatusChecks
        in: query
        description: true = Skip account status checks to improve response time
        required: false
        schema:
          type: boolean
      requestBody:
        $ref: '#/components/requestBodies/AwsCloudAccountRequestModel2'
      responses:
        '200':
          description: successful operation
        '400':
          description: duplicate_cloud_account_name / duplicate_cloud_account / cannot_select_zero_account_groups / invalid_account_group_ids / invalid_account_type
        '404':
          description: invalid_account_id_format
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_account/{parent_id}/children:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: List Children of Parent (AWS)
      description: For AWS only. Lists all the children of the given parent organizational unit (OU).The listed children include both OU resources and account resources.
      operationId: get-list-of-children-under-parent-aws
      parameters:
      - name: parent_id
        in: path
        description: Parent OU ID
        required: true
        schema:
          type: string
      - name: accountNextPageToken
        in: query
        description: The page token to request the next page of accounts. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        required: false
        schema:
          type: string
      - name: accountFetchCount
        in: query
        description: Total number of accounts to return. An  **accountFetchCount** of 0 returns a nextPageToken but no accounts.
        required: false
        schema:
          type: integer
          format: int32
      - name: ouNextPageToken
        in: query
        description: The page token to request next set of OUs. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        required: false
        schema:
          type: string
      - name: ouFetchCount
        in: query
        description: Total number of OUs to return. An **ouFetchCount** of 0 returns a nextPageToken but no OUs.
        required: false
        schema:
          type: integer
          format: int32
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AwsOrgChildrenRequestModel'
        description: Cloud Account JSON
        required: true
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AwsListChildrenApiResponseModel'
        '400':
          description: permission_error / bad_request
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/cloud_account/status/aws:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: Get Cloud Account Status (AWS)
      description: Lists status messages of the specified AWS cloud account.
      operationId: get-aws-cloud-account-status
      parameters:
      - name: automatedFlow
        in: query
        required: false
        schema:
          type: boolean
      requestBody:
        $ref: '#/components/requestBodies/AwsCloudAccountRequestModel'
      responses:
        '200':
          description: successful operation
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/CloudAccountStatus'
        '400':
          description: bad_request
        '412':
          description: external_id_empty_or_not_generated. To generate CFT and externalId call **[Generate and Download the AWS CFT Template endpoint](/prisma-cloud/api/cspm/generate-cft-template-aws)** or **[Generate the AWS CFT Template Link Endpoint](/prisma-cloud/api/cspm/generate-cft-template-link-aws)**
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{account_id}/ancestors:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: List Ancestors (AWS) - Legacy
      description: For AWS only. Lists the ancestors of the given member accounts and organizational units (OUs) for the specified cloud account ID. A successful response returns an array of accounts and/or OUs each of which is mapped to an array of ancestor resource IDs.
      operationId: get-ancestors-for-given-members-ous-legacy
      parameters:
      - name: account_id
        in: path
        description: Account ID
        required: true
        schema:
          type: string
      requestBody:
        $ref: '#/components/requestBodies/get-ancestors-for-given-members-ous-legacyBody'
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/AwsNodeModel'
        '400':
          description: bad_request / unauthorized_access
        '404':
          description: invalid_account_id_format
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cloud-accounts-manager/v1/cloudAccounts/awsAccounts/{parent_id}/children:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: List Children of Parent (AWS) - Legacy
      description: Lists all the children of the given parent organizational unit (OU).The listed children include both OU resources and account resources.
      operationId: get-list-of-children-under-parent-aws-legacy
      parameters:
      - name: parent_id
        in: path
        description: Parent OU ID
        required: true
        schema:
          type: string
      - name: accountNextPageToken
        in: query
        description: The page token to request the next page of accounts. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        required: false
        schema:
          type: string
      - name: accountFetchCount
        in: query
        description: Total number of accounts to return. An  **accountFetchCount** of 0 returns a nextPageToken but no accounts.
        required: false
        schema:
          type: integer
          format: int32
      - name: ouNextPageToken
        in: query
        description: The page token to request next set of OUs. The response from a previous request provides this token. If the token has characters outside the ASCII character set, URL encode the token before using it to make a request.
        required: false
        schema:
          type: string
      - name: ouFetchCount
        in: query
        description: Total number of OUs to return. An **ouFetchCount** of 0 returns a nextPageToken but no OUs.
        required: false
        schema:
          type: integer
          format: int32
      requestBody:
        $ref: '#/components/requestBodies/get-ancestors-for-given-members-ous-legacyBody'
      responses:
        '200':
          description: success
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AwsListChildrenApiResponseModel'
        '400':
          description: permission_error / bad_request
      security:
      - x-redlock-auth: []
      x-public: 'true'
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /dlp/api/v1/config/awsorg/status:
    post:
      deprecated: true
      description: Returns whether or not the set up for your AWS Organization meets the prerequisites for successful creation of a data security configuration.
      operationId: get-status-for-org
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/AWSOrgStatusConfigModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AWSOrgStatusResponseModel'
          description: success
        '400':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/DLPAPIResponse'
          description: bad_request
      security:
      - x-redlock-auth: []
      summary: Check Data Security Preconditions (AWS Org)
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /dlp/api/config/v2:
    post:
      deprecated: true
      description: Creates a data security configuration for an AWS Organization.
      operationId: onboard-aws-org-scan
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/AWSOrgRequestConfigModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/DLPAPIResponse'
          description: success
      security:
      - x-redlock-auth: []
      summary: Add Data Security Config (AWS Org)
      tags:
      - Cloud Accounts (AWS)
    put:
      deprecated: true
      description: Updates the data security configuration for the AWS Organization with the specified account ID.
      operationId: update-aws-org-scan-config
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/AWSOrgRequestConfigModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/DLPAPIResponse'
          description: success
      security:
      - x-redlock-auth: []
      summary: Update Data Security Config (AWS Org)
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /dlp/api/config/v2/{accountId}:
    get:
      deprecated: true
      description: Returns the data security configuration for the AWS Organization with the specified account ID.
      operationId: get-aws-org-scan-details
      parameters:
      - description: AWS account ID
        in: path
        name: accountId
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/AWSOrgConfig'
          description: success
      security:
      - x-redlock-auth: []
      summary: Get Data Security Config (AWS Org)
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_template/presigned_url:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: Generate the CFT Template Link (AWS)
      description: "Generates the AWS Cloudformation Stack Quick create link with S3 presigned CFT URL. The Generated CFT template will include Prisma Cloud generated externalId and the permissions based on selected features.\n\n The response contains *createStackLinkWithS3PresignedUrl* key whose value can be used to create IAM role via AWS CloudFormation stack.\n\n There are 2 ways to create IAM role:\n\n 1. [Manual] If you are logged into your AWS Management console, directly open the value of the *createStackLinkWithS3PresignedUrl* key on a new tab in the browser.\n 2. [Automation] Else, you can extract the actual S3 Presigned CFT URL from the *createStackLinkWithS3PresignedUrl* key by splitting at templateURL= and url decoding the last index of the split(i.e right part of the split). This extracted decoded link can be used to create or update the IAM role CloudFormation stack. \n\n  **NOTE**: The *createStackLinkWithS3PresignedUrl* link is valid for 1hr"
      operationId: generate-cft-template-link-aws
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AWSTemplateGenRequest'
        required: true
      responses:
        '200':
          description: Template Generated Successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AWSCFTGenResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '401':
          description: Unauthorized Access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '403':
          description: Tenant License Expired
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '405':
          description: Wrong Http Method
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '425':
          description: Too Early to access the resource
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '429':
          description: Rate Limit Exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      x-public: 'true'
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /cas/v1/aws_template:
    post:
      tags:
      - Cloud Accounts (AWS)
      summary: Generate and Download the CFT Template (AWS)
      description: "Generates the AWS CFT template. The Generated CFT template includes Prisma Cloud generated externalId and the permissions based on selected features.\n The CFT template can be used to create IAM role via AWS CloudFormation stack."
      operationId: generate-cft-template-aws
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AWSTemplateGenRequest'
        required: true
      responses:
        '200':
          description: Template Generated Successfully
        '400':
          description: Bad Request/Bad Request with accountType account, only valid cftType is account/Bad Request with accountType organization, cftType account is not valid/AccountType can be one of the following [account , organization]/AccountId is not valid Feature list is invalid /Invalid usage of customMemberRoleNameEnabled
        '401':
          description: Unauthorized Access
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '403':
          description: Tenant License Expired
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '405':
          description: Wrong Http Method
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '425':
          description: Too Early to access the resource
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
        '429':
          description: Rate Limit Exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApiError'
      x-public: 'true'
      security:
      - x-redlock-auth: []
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /config/v3/account/awsorg/{id}:
    get:
      summary: Fetch Master Account Details (AWS Org)
      description: Returns the necessary attributes that define the AWS ORG account necessary for various PCDS flows.
      operationId: getAwsOrgCloudConfig
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: success
          content:
            application/json: {}
        '400':
          description: bad_request
      x-public: 'true'
      security:
      - x-redlock-auth: []
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /config/v3/account/awsorg/{id}/status:
    get:
      summary: Performs a Permissions Check for the Given PCDS Account (AWS Org)
      description: Returns details pertaining to the rudimentary permissions check - contains details pertaining to any missing permissions.
      operationId: get-status-pcds-aws-org-account
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: success
          content:
            application/json: {}
      x-public: 'true'
      security:
      - x-redlock-auth: []
      tags:
      - Cloud Accounts (AWS)
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
components:
  schemas:
    CloudAccountStatus:
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        status:
          type: string
        statusMessage:
          $ref: '#/components/schemas/AccountStatusMessage'
    AwsListChildrenApiResponseModel:
      type: object
      properties:
        response:
          type: array
          description: List of node info
          items:
            $ref: '#/components/schemas/AwsOrgTreeNode'
        accountNextPageToken:
          type: string
          description: Next page token for account
        ouNextPag

# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-cloud-accounts-aws-api-openapi.yml