Palo Alto Networks Compliance API

openapi: 3.2.0
info:
  title: Palo Alto Networks Prisma Cloud CSPM Compliance API
  description: REST API for Prisma Cloud Security Posture Management providing programmatic access to cloud security monitoring across AWS, Azure, GCP, and Oracle Cloud. The API supports managing security alerts, compliance policies, cloud account onboarding, asset inventories, and resource queries using RQL (Resource Query Language). Authentication uses JWT tokens obtained from the /login endpoint with access key credentials. Tokens are valid for 10 minutes and must be refreshed for long-running operations.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.prismacloud.io
  description: Prisma Cloud API (US region 1).
- url: https://api2.prismacloud.io
  description: Prisma Cloud API (US region 2).
- url: https://api3.prismacloud.io
  description: Prisma Cloud API (US region 3).
- url: https://api.eu.prismacloud.io
  description: Prisma Cloud API (EU).
- url: https://api.anz.prismacloud.io
  description: Prisma Cloud API (ANZ).
- url: https://api.sg.prismacloud.io
  description: Prisma Cloud API (Singapore).
- url: https://api.ca.prismacloud.io
  description: Prisma Cloud API (Canada).
security:
- bearerAuth: []
tags:
- name: Compliance
  description: Compliance posture and reporting.
paths:
  /compliance:
    get:
      operationId: listComplianceStandards
      summary: Palo Alto Networks List Compliance Standards
      description: Returns a list of compliance standards available in Prisma Cloud, including built-in standards (CIS, NIST, PCI-DSS, HIPAA, SOC 2) and custom standards.
      tags:
      - Compliance
      responses:
        '200':
          description: Compliance standards returned successfully.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ComplianceStandard'
              examples:
                ListComplianceStandards200Example:
                  summary: Default listComplianceStandards 200 response
                  x-microcks-default: true
                  value:
                  - id: example-id
                    name: Staging Policy 79
                    description: Incident activity activity monitoring monitoring activity detected alert configured monitoring.
                    cloudType:
                    - custom
                    systemDefault: true
                    policiesAssigned: 146
                    createdBy: example-createdBy
                    lastModifiedTs: 756
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  responses:
    Unauthorized:
      description: Invalid or expired JWT token.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: Insufficient permissions for this operation.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    ComplianceStandard:
      type: object
      properties:
        id:
          type: string
          description: Unique compliance standard identifier.
          example: example-id
        name:
          type: string
          description: Name of the compliance standard.
          example: Staging Policy 79
        description:
          type: string
          description: Standard description.
          example: Incident activity activity monitoring monitoring activity detected alert configured monitoring.
        cloudType:
          type: array
          items:
            type: string
          description: Cloud providers the standard applies to.
          example:
          - custom
        systemDefault:
          type: boolean
          description: Whether this is a built-in compliance standard.
          example: true
        policiesAssigned:
          type: integer
          description: Number of policies mapped to this standard.
          example: 146
        createdBy:
          type: string
          description: User who created the standard.
          example: example-createdBy
        lastModifiedTs:
          type: integer
          description: Epoch timestamp of last modification.
          example: 756
    ErrorResponse:
      type: object
      properties:
        status:
          type: integer
          description: HTTP status code.
          example: 747
        message:
          type: string
          description: Human-readable error message.
          example: Traffic violation investigation monitoring policy incident applied threat monitoring alert.
        error:
          type: string
          description: Error code.
          example: example-error
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: 'JWT token obtained from the /login endpoint. Valid for 10 minutes. Include as Authorization: Bearer <token> in request headers.'