Palo Alto Networks

Palo Alto Networks IAM API

Prisma Cloud identity and access management (IAM) security provides: * Visiblity—Query all relevant IAM entities * Gonvernance—Monitor your cloud environment for overly-used permissions * Response—Automatically remediate permissions The IAM security endpoints enable you to investigate IAM data programmatically. See [Primsa Cloud IAM Security](https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/prisma-cloud-iam-security/what-is-prisma-cloud-iam-security.html) for more information. ### Error Handling Like other Prisma Cloud public API requests, the IAM security API requests return standard HTTP response codes. Unlike most other CSPM API error handling, IAM security API error responses do not include an [x-redlock-status](//prisma-cloud/api/cspm/api-errors) in the response header. ### Pagination You can control the number of items in a response for endpoints that support pagination. Use request parameter **limit** to control the maximum number of items in a response. If the response includes **data.nextPageToken**, use **data.nextPageToken** as the request parameter **pageToken** in a request for the next page of data. The following table summarizes the request parameters for pagination: Request Parameter | Description -----------| ------- **limit** | Maximum number of items to return in a page. **pageToken** | Use the **data.nextPageToken** value from the previous response object to return the next page of data.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 21

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /api/v1/permission Run an IAM query to list permissions · Get Permissions #
Ask an LLM
“How do I run an IAM query in Prisma Cloud to see who can access what?”
“Can I cap how many permission results the original IAM permission search returns?”
Tell an agent
Run IAM query {query} and return the first {limit} permissions.
Execute the v1 IAM permission query {query} with a limit of {limit}.
POST /api/v1/permission/page Get the next page of IAM permission results · Get Permissions Next Page #
Ask an LLM
“What do I pass to fetch the next page after a v1 IAM permissions query?”
“Can I page through more permission rows using the token from my last query?”
Tell an agent
Fetch the next page of permissions using page token {pageToken}.
Continue the v1 permissions results from token {pageToken}, {limit} rows at a time.
POST /api/v1/permission/access See when a permission was last used · Get Permissions Access #
Ask an LLM
“How can I tell when a specific IAM permission was actually last used?”
“Is there a way to see last-access data for one permission ID under an IAM query?”
Tell an agent
Show last-access usage for permission {permissionId} under query {query}.
Get up to {limit} last-access records for permission {permissionId} matching {query}.
POST /api/v1/permission/access/page Get the next page of permission last-access data · Get Permissions Access Next Page #
Ask an LLM
“How do I keep paging through permission last-access results in v1?”
“Can I continue a permission usage listing with the token it returned?”
Tell an agent
Get the next page of permission access records with token {pageToken}.
Continue listing permission last-access data from token {pageToken}.
POST /api/v1/permission/alert/remediation Get remediations for IAM alerts · Get Remediation #
Ask an LLM
“How do I get suggested remediations for a batch of IAM alerts?”
“Can I fetch fixes for several alert IDs in a single call?”
Tell an agent
Get remediations for alerts {alerts}.
List the remediation steps for IAM alert IDs {alerts}.
GET /api/v1/permission/alert/search Get the IAM query behind an alert · Get IAM Query #
Ask an LLM
“Which IAM query triggered a given alert, using the original v1 lookup?”
“Can I see the RQL an IAM alert was raised from by passing its alert ID as a query parameter?”
Tell an agent
Show the IAM query for alert {alertId} with the v1 search endpoint.
Look up the RQL behind alert {alertId}.
POST /api/v1/suggest Get autocomplete suggestions for an IAM query · Get Query Suggestions #
Ask an LLM
“How can I tell whether my partial IAM query is valid yet?”
“What can I append to a half-written IAM query to complete it in the v1 suggest endpoint?”
Tell an agent
Suggest completions for the partial IAM query {query}.
Check if {query} is a valid IAM query and suggest what comes next.
POST /iam/api/v3/search/permission Search IAM permissions with the v3 API · Get Permissions V3 #
Ask an LLM
“How do I search permissions with the v3 IAM search and get a next page token?”
“Can I limit the page size when searching permissions in v3?”
Tell an agent
Search permissions in v3 with query {query}.
Run v3 permission search {query}, {limit} per page, continuing from token {nextPageToken}.
POST /iam/api/v4/search/permission Search permissions grouped by fields (v4) · Get Permissions V4 #
Ask an LLM
“Can I group IAM permission search results by specific fields?”
“What does the v4 permission search return compared to a flat list?”
Tell an agent
Search permissions with query {query} grouped by {groupByFields}.
Run a v4 grouped permission search for {query}.
POST /iam/api/v3/permission/{permission-id}/list_access List last accesses of a permission (v3) · Get Permission Accesses V3 #
Ask an LLM
“How do I list the recent accesses for one permission ID in the v3 API?”
“Can I page through a permission's last-access history with a token?”
Tell an agent
List v3 last accesses for permission {permission_id} filtered by {query}.
Get the next {limit} accesses of permission {permission_id} from token {nextPageToken}.
POST /iam/api/v2/suggestion Autocomplete an RQL query (v2) · Get Query Suggestions V2 #
Ask an LLM
“Is there a newer suggestion endpoint that autocompletes RQL and flags invalid queries?”
“How do I get v2 autocomplete hints for the RQL I'm typing?”
Tell an agent
Autocomplete RQL {query} using v2 suggestions.
Tell me whether RQL {query} is valid via the v2 suggestion service.
POST /iam/api/v2/search/iam_config Get the raw role or policy behind a permission · Get Permissions Role or Policy Definition V2 #
Ask an LLM
“Can I see the raw policy or role definition a permission was calculated from?”
“Where does a given IAM permission come from in the underlying config?”
Tell an agent
Show the raw policy or role definition for permission {permissionId}.
Get the source IAM config for permission {permissionId}.
GET /iam/api/v2/alert/{alertId}/remediation_command Get the remediation command for an alert · Get Remediation Command #
Ask an LLM
“Is there a ready-made CLI command to remediate a specific IAM alert?”
“How do I get the fix command for one alert ID?”
Tell an agent
Get the remediation command for alert {alertId}.
Give me the command that fixes alert {alertId}.
GET /iam/api/v2/alert/{alertId}/query Get the query for an alert instance (v2) · Get IAM Query V2 #
Ask an LLM
“How do I investigate an alert by pulling the query tied to that alert instance in v2?”
“Can I get the v2 IAM query associated with an alert from its path ID?”
Tell an agent
Get the v2 query associated with alert {alertId}.
Investigate alert {alertId} by retrieving its IAM query.
GET /iam/api/v1/assets/{assetId}/over-permissive-metadata Check least-privilege potential for an asset · Get Least Privilege Access Metadata of an Asset #
Ask an LLM
“Is this asset over-permissive, and how much could least privilege improve it?”
“What metadata is available about least-privilege improvement for an asset?”
Tell an agent
Show least-privilege improvement metadata for asset {assetId}.
Check whether asset {assetId} is over-permissive.
GET /iam/api/v1/assets/{assetId}/existing-least-privileged-access Suggest least privilege from existing roles for an asset · Get Existing Least Privilege Access Suggestions for an Asset #
Ask an LLM
“Can I right-size an asset's access using only roles and policies that already exist?”
“How many days of activity does the existing-roles least-privilege suggestion look back over?”
Tell an agent
Suggest least privilege for asset {assetId} from existing policies over the last {lookback_duration_days} days as {output_format}.
Recommend existing roles for asset {assetId}, {lookback_duration_days}-day lookback, {output_format} output.
GET /iam/api/v1/assets/{assetId}/custom-least-privileged-access Generate a custom least-privilege policy for an asset · Get New Least Privilege Access Suggestions for an Asset #
Ask an LLM
“Can Prisma Cloud generate a brand-new least-privilege policy for an asset?”
“Which output formats can a custom least-privilege config for an asset come in?”
Tell an agent
Generate a custom least-privilege config for asset {assetId} from {lookback_duration_days} days of use in {output_format}.
Create a new tailored policy for asset {assetId} covering {lookback_duration_days} days, format {output_format}.
GET /iam/api/v1/resources/{resourceId}/over-permissive-metadata Check least-privilege potential for a resource · Get Least Privilege Access Metadata of a Resource #
Ask an LLM
“Does a particular cloud resource have room for access optimization?”
“Where can I see over-permissive metadata keyed by resource ID rather than asset ID?”
Tell an agent
Show over-permissive metadata for resource {resourceId}.
Check if resource {resourceId} could have its access tightened.
GET /iam/api/v1/resources/{resourceId}/existing-least-privileged-access Suggest least privilege from existing roles for a resource · Get Least Privilege Access Suggestions for a Resource #
Ask an LLM
“Can I tighten a resource's access by reusing its current IAM configurations?”
“How do I get existing-policy least-privilege suggestions by resource ID?”
Tell an agent
Suggest existing-role least privilege for resource {resourceId} over {lookback_duration_days} days in {output_format}.
Recommend current policies to keep for resource {resourceId}, lookback {lookback_duration_days} days, as {output_format}.
GET /iam/api/v1/resources/{resourceId}/custom-least-privileged-access Generate a custom least-privilege policy for a resource · Get New Least Privilege Access Suggestions for a Resource #
Ask an LLM
“Can I generate a new custom least-privilege config for a specific resource?”
“What would a tailored minimal policy look like for a resource based on recent actions?”
Tell an agent
Generate a custom least-privilege policy for resource {resourceId} from {lookback_duration_days} days in {output_format}.
Build a new minimal access config for resource {resourceId}, {lookback_duration_days}-day window, {output_format} format.

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-iam-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/palo-alto-networks:palo-alto-networks-iam-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

palo-alto-networks-iam-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Palo Alto Networks IAM API
  version: '1.0'
  description: 'Operations tagged IAM across 2 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-iamv2microservice-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:


# --- truncated at 32 KB (94 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-iam-api-openapi.yml