Palo Alto Networks Command Center API

openapi: 3.2.0
info:
  title: pcs-command-center Command Center API
  version: 1.0.0-SNAPSHOT
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- name: Command Center
  x-public: 'true'
  x-ga: 23.10.2
paths:
  /commandcenter/api/v1/summary/{swimlane-type}:
    post:
      tags:
      - Command Center
      summary: List Total Alerts based on the severity
      description: Gets the alert count summary based on the severity for the request time, accounts, account groups and swimlane type. Maximum time range supported is last 30 days.
      operationId: command-center-list-total-alerts-by-severity
      parameters:
      - name: swimlane-type
        in: path
        description: 'Type of the swimlane. Allowed values: [misconfigurations, incidents, exposures, iam, data-security, attack-path]'
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SwimlaneApiRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SummaryResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: Too Many Requests
      security:
      - x-redlock-auth: []
      x-public: 'true'
      x-ga: 23.10.2
  /commandcenter/api/v1/top-assets/{swimlane-type}:
    post:
      tags:
      - Command Center
      summary: List Top N assets
      description: Gets the data for the top N assets with highest alerts, based on the type for the request time, accounts account groups and swimlane type. Maximum time range supported is last 30 days.
      operationId: command-center-list-top-assets
      parameters:
      - name: swimlane-type
        in: path
        description: 'Type of the swimlane. Allowed values: [misconfigurations, incidents, exposures, iam, data-security, attack-path]'
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TopResourcesApiRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TopAssetsResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: Too Many Requests
      x-public: 'true'
      x-ga: 23.10.2
      security:
      - x-redlock-auth: []
  /commandcenter/api/v1/top-policies/{swimlane-type}:
    post:
      tags:
      - Command Center
      summary: List Top Policies
      description: Gets the data for the top N policies with most alerts, based on the type for the request time, accounts, account groups and swimlane type. Maximum time range supported is last 30 days.
      operationId: command-center-list-top-policies
      parameters:
      - name: swimlane-type
        in: path
        description: 'Type of the swimlane. Allowed values: [misconfigurations, incidents, exposures, iam, data-security, attack-path]'
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TopResourcesApiRequest'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TopPoliciesResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: Too Many Requests
      security:
      - x-redlock-auth: []
      x-public: 'true'
      x-ga: 23.10.2
  /commandcenter/v1/top-vulnerabilities:
    post:
      tags:
      - Command Center
      summary: List Top Vulnerabilities
      description: Gets the data for the top 5 hosts and top 5 images with highest number of vulnerabilities, based on the type for the request time, accounts and account groups
      operationId: command-center-list-top-vulnerabilities
      parameters:
      - name: limit
        in: query
        schema:
          format: int64
          type: integer
      - name: type
        in: query
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VulnerabilityRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VulnerabilityResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: Too Many Requests
      security:
      - x-redlock-auth: []
      x-public: 'true'
  /commandcenter/v1/vulnerabilities/summary:
    post:
      tags:
      - Command Center
      summary: List Total Vulnerable Images and Hosts
      description: Gets the summary data for all the vulnerable images and hosts, for the request time, accounts and account groups
      operationId: command-center-list-total-vulnerable-images-hosts
      parameters:
      - name: prismaId
        in: query
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VulnerabilityRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TotalVulnerabilitiesResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: Too Many Requests
      x-public: 'true'
      security:
      - x-redlock-auth: []
components:
  schemas:
    AbsoluteTimeRangeConfig:
      type: object
      properties:
        type:
          description: 'Type of time ranges supported: [absolute, relative]'
          type: string
        value:
          description: Absolute Time containing start and end time. Maximum time range supported is last 30 days.
          type: object
          allOf:
          - $ref: '#/components/schemas/Time'
    SummaryResponse:
      type: object
      properties:
        value:
          description: Alert count details
          type: object
          allOf:
          - $ref: '#/components/schemas/AlertsCounts'
        startTime:
          format: int64
          description: Start time of the time range
          type: integer
        endTime:
          format: int64
          description: End time of the time range
          type: integer
        swimlaneType:
          description: Type of the swimlane
          type: string
        lastScanTs:
          format: int64
          description: Last scan time of the backend aggregation job
          type: integer
    TopPolicyInfo:
      type: object
      properties:
        policyId:
          description: Id of the policy
          type: string
        policyName:
          description: Name of the policy
          type: string
        policyType:
          description: Type of the policy
          type: string
        severity:
          description: Severity of the policy
          type: string
        alertCount:
          format: int64
          description: Total number of alerts associated with the policy
          type: integer
        policyDescription:
          description: Description of the policy
          type: string
    TotalVulnerabilitiesResponse:
      type: object
      properties:
        value:
          $ref: '#/components/schemas/TotalVulnerabilitiesByType'
        date:
          type: string
        ts:
          format: int64
          type: integer
        lastScanTs:
          format: int64
          type: integer
    VulnerabilityRequest:
      type: object
      properties:
        filters:
          type: array
          items:
            $ref: '#/components/schemas/Filter'
        timeRange:
          $ref: '#/components/schemas/TimeRangeConfig'
    TopPoliciesResponse:
      type: object
      properties:
        value:
          description: List of top policies details
          type: array
          items:
            $ref: '#/components/schemas/TopPolicyInfo'
        startTime:
          format: int64
          description: Start time of the time range
          type: integer
        endTime:
          format: int64
          description: End time of the time range
          type: integer
        swimlaneType:
          description: Type of the swimlane
          type: string
        lastScanTs:
          format: int64
          description: Last scan time of the backend aggregation job
          type: integer
    Filter:
      type: object
      properties:
        name:
          description: 'Name of the allowed Filter types. Allowed names: [account.group, cloud.account]'
          type: string
          allOf:
          - $ref: '#/components/schemas/FilterType'
        operator:
          description: Only allowed operator for the filter is '='
          type: string
        value:
          description: Value for the applied filter
          type: string
    VulnerabilityCounts:
      type: object
      properties:
        totalCriticalVulnerabilities:
          format: int64
          type: integer
        totalHighVulnerabilities:
          format: int64
          type: integer
    TopAssetInfo:
      type: object
      properties:
        externalResourceId:
          description: Id of the asset
          type: string
        resourceName:
          description: Name of the asset
          type: string
        cloudName:
          description: Cloud type name of the asset
          type: string
        serviceName:
          description: Service name of the asset
          type: string
        accountName:
          description: Account name of the asset
          type: string
        alertCount:
          format: int64
          description: Total number of alerts associated with the asset
          type: integer
        criticalAlertCount:
          format: int64
          description: Total number of critical severity alerts associated with the asset
          type: integer
        highAlertCount:
          format: int64
          description: Total number of high severity alerts associated with the asset
          type: integer
    AlertsCounts:
      type: object
      properties:
        totalCriticalAlerts:
          format: int64
          description: Total number of alerts with critical severity
          type: integer
        totalHighAlerts:
          format: int64
          description: Total number of alerts with high severity
          type: integer
    TopAssetsResponse:
      type: object
      properties:
        value:
          description: List of top asset details
          type: array
          items:
            $ref: '#/components/schemas/TopAssetInfo'
        startTime:
          format: int64
          description: Start time of the time range
          type: integer
        endTime:
          format: int64
          description: End time of the time range
          type: integer
        swimlaneType:
          description: Type of the swimlane
          type: string
        lastScanTs:
          format: int64
          description: Last scan time of the backend aggregation job
          type: integer
    VulnerableAssets:
      type: object
      properties:
        unifiedAssetId:
          type: string
        resourceName:
          type: string
        numCriticalVulnerabilities:
          format: int64
          type: integer
        numHighVulnerabilities:
          format: int64
          type: integer
        totalVulnerabilities:
          format: int64
          type: integer
    TotalVulnerabilitiesByType:
      type: object
      properties:
        images:
          $ref: '#/components/schemas/VulnerabilityCounts'
        hosts:
          $ref: '#/components/schemas/VulnerabilityCounts'
        totalBySeverity:
          $ref: '#/components/schemas/VulnerabilityCounts'
    FilterType:
      enum:
      - account.group
      - cloud.account
      type: string
    RelativeTimeRangeConfig:
      type: object
      properties:
        type:
          description: 'Type of time ranges supported: [absolute, relative]'
          type: string
        value:
          description: Relative time supporting past hour, week and month. Maximum time range supported is 1 month
          type: object
          allOf:
          - $ref: '#/components/schemas/RelativeTimeDuration'
    VulnerabilityResponse:
      type: object
      properties:
        value:
          type: array
          items:
            $ref: '#/components/schemas/VulnerableAssets'
        date:
          type: string
        ts:
          format: int64
          type: integer
        lastScanTs:
          format: int64
          type: integer
    TopResourcesApiRequest:
      required:
      - timeRange
      type: object
      properties:
        filters:
          description: List of filters that can be applied for the API
          type: array
          items:
            $ref: '#/components/schemas/Filter'
        timeRange:
          description: Time range for which the API is requested
          type: object
          allOf:
          - $ref: '#/components/schemas/TimeRangeConfig'
        limit:
          format: int32
          description: Limit on the number of resources requested
          default: 5
          maximum: 10
          minimum: 1
          type: integer
    TimeRangeConfig:
      type: object
      properties:
        type:
          description: 'Type of time ranges supported: [absolute, relative]'
          type: string
        value:
          type: object
      oneOf:
      - $ref: '#/components/schemas/AbsoluteTimeRangeConfig'
      - $ref: '#/components/schemas/RelativeTimeRangeConfig'
    Error:
      type: object
      properties:
        code:
          type: string
        message:
          type: string
        target:
          type: string
    RelativeTimeDuration:
      type: object
      properties:
        unit:
          $ref: '#/components/schemas/TimeUnit'
        amount:
          format: int32
          type: integer
    TimeUnit:
      enum:
      - hour
      - week
      - month
      - year
      type: string
    SwimlaneApiRequest:
      required:
      - timeRange
      type: object
      properties:
        filters:
          description: List of filters that can be applied for the API
          type: array
          items:
            $ref: '#/components/schemas/Filter'
        timeRange:
          description: Time range for which the API is requested
          type: object
          allOf:
          - $ref: '#/components/schemas/TimeRangeConfig'
    ErrorResponse:
      type: object
      properties:
        error:
          $ref: '#/components/schemas/Error'
    Time:
      type: object
      properties:
        startTime:
          format: int64
          type: integer
        endTime:
          format: int64
          type: integer
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey