Permission groups enable you to restrict access to one or more features available on the Prisma Cloud administrative console. Permission group APIs allow you to retrieve, update or delete one or more existing permissions groups. You can also use these APIs to create a custom permission group and then you must attach it to a role and assign the role to a user.
openapi: 3.2.0
info:
title: Palo Alto Networks Permission Groups API
version: '1.0'
description: 'Operations tagged Permission Groups across 2 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-permissiongroupsmicroservice-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: Permission groups enable you to restrict access to one or more features available on the Prisma Cloud administrative console. Permission group APIs allow you to retrieve, update or delete one or more existing permissions groups. You can also use these APIs to create a custom permission group and then you must attach it to a role and assign the role to a user.
name: Permission Groups
paths:
/authz/v1/feature:
get:
tags:
- Permission Groups
summary: Get all active features
description: Returns a list of Prisma Cloud features that can be added to Custom Permission Groups
operationId: getFeatures
responses:
'200':
description: Successful operation
content:
application/json:
schema:
type: array
items:
type: string
4XX:
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
type: array
items:
type: string
security:
- x-redlock-auth: []
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/authz/v1/permission_group/{id}:
get:
tags:
- Permission Groups
summary: Get an existing Permission Group by ID
description: Queries a list of existing permission groups by ID and returns a specific permission group that matches the Permission Group ID.
operationId: get_1
parameters:
- name: id
in: path
description: PermissionGroupID
required: true
schema:
type: string
- name: includeAssociatedRoles
in: query
description: To include associated roles in the response
required: false
schema:
type: boolean
responses:
'200':
description: Successful operation
content:
application/json:
schema:
$ref: '#/components/schemas/PermissionGroupDetail'
4XX:
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
$ref: '#/components/schemas/PermissionGroupDetail'
security:
- x-redlock-auth: []
put:
tags:
- Permission Groups
summary: Update an existing Permission Group
description: Updates the parameters of an existing permission group.
operationId: update_1
parameters:
- name: id
in: path
description: PermissionGroupId
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PermissionGroupRequest'
required: true
responses:
'204':
description: Successful operation
4XX:
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
security:
- x-redlock-auth: []
delete:
tags:
- Permission Groups
summary: Delete an existing Permission Group by ID
description: Deletes the default or custom permission group with the specified ID.
operationId: delete
parameters:
- name: id
in: path
description: PermissionGroupID
required: true
schema:
type: string
responses:
'204':
description: Successful operation
4XX:
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
security:
- x-redlock-auth: []
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/authz/v1/permission_group:
get:
tags:
- Permission Groups
summary: Get all existing Permission Groups
description: Returns a list of all existing Permission Groups.
operationId: getAll
parameters:
- name: includeAssociatedRoles
in: query
description: To include associated roles in the response
required: false
schema:
type: boolean
- name: includeFeatures
in: query
description: To include permitted features in the response
required: false
schema:
type: boolean
responses:
'200':
description: Successful operation
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/PermissionGroupDetail'
4XX:
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/PermissionGroupDetail'
security:
- x-redlock-auth: []
post:
tags:
- Permission Groups
summary: Add new Custom Permission Group
description: Creates a new custom permission group with granular permissions that restrict access to the Prisma Cloud administrative console. Values include name, optional description and selection of enabled features and functions.
operationId: save
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/PermissionGroupRequest'
required: true
responses:
'201':
description: Successful operation
4XX:
description: Client error
headers:
x-redlock-status:
description: error description
style: simple
schema:
type: string
security:
- x-redlock-auth: []
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
components:
schemas:
PermissionGroupDetail:
type: object
properties:
name:
type: string
description: Permission Group Name
description:
type: string
description: Permission Group Description
type:
type: string
description: Permission Group Type
enum:
- Default
- Custom
- Internal
- Default
- Custom
lastModifiedBy:
type: string
lastModifiedTs:
type: integer
format: int64
associatedRoles:
type: object
additionalProperties:
type: object
description: Map of associated role Ids and Names
description: Map of associated role Ids and Names
features:
$ref: '#/components/schemas/Feature1'
acceptAccountGroups:
type: boolean
description: acceptAccountGroups
acceptResourceLists:
type: boolean
description: acceptResourceLists
acceptCodeRepositories:
type: boolean
description: acceptCodeRepositories
custom:
type: boolean
description: Boolean value signifying whether this is a custom (i.e. user-defined) permission group. Is set to true if the attribute value of permissionGroupType is set to CUSTOM
id:
type: string
description: Permission Group ID
PermissionGroupRequest:
title: Model used for permission group
required:
- features
- name
type: object
properties:
name:
type: string
description: Permission Group Name
description:
type: string
description: Permission Group Description
features:
type: array
description: List of Prisma Cloud Features
items:
$ref: '#/components/schemas/Feature1'
Feature1:
required:
- featureName
- operations
type: object
properties:
featureName:
type: string
description: 'Prisma Cloud Feature Name. Prisma Cloud feature names can be retreived from GET: /authz/v1/feature API Endpoint'
operations:
type: object
additionalProperties:
type: object
description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
description: "Collection of permitted features associated with the role. \n Refer to PermissionGroup API docs to get the entire list of PC features."
PermissionGroupDetail_2:
type: object
properties:
name:
type: string
description: Permission Group Name
description:
type: string
description: Permission Group Description
type:
type: string
description: Permission Group Type
enum:
- Default
- Custom
lastModifiedBy:
type: string
lastModifiedTs:
type: integer
format: int64
associatedRoles:
type: object
additionalProperties:
type: object
description: Map of associated role Ids and Names
description: Map of associated role Ids and Names
features:
$ref: '#/components/schemas/Feature'
acceptAccountGroups:
type: boolean
description: acceptAccountGroups
acceptResourceLists:
type: boolean
description: acceptResourceLists
acceptCodeRepositories:
type: boolean
description: acceptCodeRepositories
custom:
type: boolean
description: Boolean value signifying whether this is a custom (i.e. user-defined) permission group. Is set to true if the attribute value of permissionGroupType is set to CUSTOM
id:
type: string
description: Permission Group ID
PermissionGroupRequest_2:
title: Model used for permission group
required:
- features
- name
type: object
properties:
name:
type: string
description: Permission Group Name
description:
type: string
description: Permission Group Description
features:
type: array
description: List of Prisma Cloud Features
items:
$ref: '#/components/schemas/Feature'
Feature:
required:
- featureName
- operations
type: object
properties:
featureName:
type: string
description: 'Prisma Cloud Feature Name. Prisma Cloud feature names can be retreived from GET: /authz/v1/feature API Endpoint'
operations:
type: object
additionalProperties:
type: object
description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
description: A mapping of operations and a boolean value representing whether the privilege to perform the operation needs to be granted.
description: List of Prisma Cloud Features
securitySchemes:
x-redlock-auth:
description: The x-redlock-auth value is a JSON Web Token (JWT).
in: header
name: x-redlock-auth
type: apiKey
externalDocs:
description: Platform Wiki Documentation
url: https://redlock.atlassian.net/wiki/spaces/RED/pages/2744877602/Platform+AuthN+Integration+Template
x-refined-from:
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json
- palo-alto-cspm-permissiongroupsmicroservice-openapi.json