Palo Alto Networks Reports API

openapi: 3.2.0
info:
  title: Palo Alto Networks Reports API
  version: '1.0'
  description: 'Operations tagged Reports across 7 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-reports-openapi.json, palo-alto-dlp-api-openapi-original.yml, palo-alto-iot-security-api-openapi-original.yml, palo-alto-networks-reports-api-openapi.yml, palo-alto-prisma-access-browser-api-openapi-original.yml, palo-alto-prisma-cloud-cspm-api-openapi-original.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
- url: https://api.dlp.paloaltonetworks.com/v4
  description: Enterprise DLP API production server.
- url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
  description: IoT Security API production server.
  variables:
    customer:
      description: Customer-specific tenant identifier.
      default: customer-tenant
- url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
  description: AIOps for NGFW BPA API production server.
- url: https://api.sase.paloaltonetworks.com/browser-mgmt
  description: SASE Prisma Access Browser Management API production server.
tags:
- description: "Creating compliance reports is the best way to monitor your cloud accounts across all cloud types and ensure that you \nare adhering to all compliance standards. You can create compliance reports based on a cloud compliance standard for \nimmediate download or schedule recurring reports so you can monitor compliance to the standard over time. From a single \nreport, you have a consolidated view of how well all of your cloud accounts are adhering to the selected standard. You \ncan also download historic reports so that you can see your compliance trend.\n"
  name: Reports
paths:
  /report:
    get:
      description: "Returns a list of compliance report generation configurations, including the ID for each configuration. Accepts query parameters to narrow the list.  \n\nOptional query parameters are available to narrow the reports list request. See \n[Get Report Overview Filters and Options](/prisma-cloud/api/cspm/get-report-filters-and-options) \nfor the REST API request to get the available query parameters.\n"
      operationId: list-reports
      parameters:
      - description: Cloud account
        in: query
        name: cloud.account
        required: false
        schema:
          type: string
      - description: Cloud type
        in: query
        name: cloud.type
        required: false
        schema:
          type: string
      - description: Cloud region
        in: query
        name: cloud.region
        required: false
        schema:
          type: string
      - description: Account group
        in: query
        name: account.group
        required: false
        schema:
          type: string
      - description: Policy compliance standard name
        in: query
        name: policy.complianceStandard
        required: false
        schema:
          type: string
      - description: Report frequency
        in: query
        name: report.frequency
        required: false
        schema:
          enum:
          - one_time
          - scheduled
          type: string
      - description: Report schedule
        in: query
        name: report.schedule
        required: false
        schema:
          enum:
          - daily
          - weekly
          - monthly
          type: string
      - description: Report email recipients
        in: query
        name: report.email.recipients
        required: false
        schema:
          type: string
      - description: Report type. Default is COMPLIANCE
        in: query
        name: report_view
        required: false
        schema:
          enum:
          - COMPLIANCE
          - RIS
          - INVENTORY_DETAIL
          - INVENTORY_OVERVIEW
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/ReportGenerationConfigApiModel'
                type: array
          description: success
      security:
      - x-redlock-auth: []
      summary: List Report Configs
      tags:
      - Reports
    post:
      description: "Creates a compliance report generation configuration based on the specified parameters. Report generation can be either one-time or recurring.  \n\nYou can use the body parameters to specify whether the report is a one-time report \nor a recurring report. Specify a recurring report by providing a valid \n**target.schedule** body parameter.\n"
      operationId: save-report
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/ReportGenerationConfigApiModel'
        description: Model for report generation configuration
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/ReportGenerationConfigApiModel'
          description: successful operation
        '400':
          description: missing_required_parameter / invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: Add Report Config
      tags:
      - Reports
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /report/type:
    get:
      description: Returns a list of the compliance report types and identifies which report types are available for each cloud type.
      operationId: get-report-types
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                additionalProperties:
                  items:
                    type: string
                  type: array
                  uniqueItems: true
                type: object
          description: success
        '400':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Report Types
      tags:
      - Reports
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /report/{id}:
    get:
      description: Returns the compliance report generation configuration with the specified ID. The response includes pass/fail counts for this ID.
      operationId: get-specified-report
      parameters:
      - description: Report ID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/ReportGenerationConfigApiModel'
          description: success
        '400':
          description: error
        '404':
          description: not_found
      security:
      - x-redlock-auth: []
      summary: Get Report Config
      tags:
      - Reports
    put:
      description: "Updates the compliance report generation configuration with the specified ID.   \n\nYou can update a recurring report schedule through this request. \nWhen using this request to update a report schedule, the only body \nparameter that is required is **target**.\n"
      operationId: update-report
      parameters:
      - description: Report ID
        in: path
        name: id
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/ReportGenerationConfigApiModel'
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/ReportGenerationConfigApiModel'
          description: success
        '400':
          description: missing_required_parameter / invalid_parameter_value
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Update Report Config
      tags:
      - Reports
    delete:
      description: Deletes the compliance report generation configuration with the specified ID.
      operationId: delete-report
      parameters:
      - description: Report ID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '204':
          description: success
        '400':
          description: error
        '404':
          description: not_found
      security:
      - x-redlock-auth: []
      summary: Delete Report Config
      tags:
      - Reports
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /report/{id}/download:
    get:
      description: Downloads the compliance report with the specified ID. If the report is scheduled, then the request downloads the latest generated report.
      operationId: download-report
      parameters:
      - description: Report ID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          description: success
        '204':
          description: pending
        '400':
          description: error
        '404':
          description: not_found / error
      security:
      - x-redlock-auth: []
      summary: Download Report
      tags:
      - Reports
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /report/{id}/history:
    get:
      description: Returns a list of metadata for the scheduled compliance reports that have been run for the specified report ID.
      operationId: get-historical-report-by-id
      parameters:
      - description: Report ID
        in: path
        name: id
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                items:
                  $ref: '#/components/schemas/ReportGenerationConfigApiModel'
                type: array
          description: success
        '400':
          description: error
        '404':
          description: not_found
        '405':
          description: method_not_allowed_for_legacy_reports
      security:
      - x-redlock-auth: []
      summary: List Historical Reports Data
      tags:
      - Reports
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /report/{id}/{lastScheduled}:
    get:
      description: Returns metadata for the scheduled compliance report that has the specified report ID and was generated on the given timestamp. Returned data includes pass/fail counts.
      operationId: get-last-scheduled-report-by-id
      parameters:
      - description: Report ID
        in: path
        name: id
        required: true
        schema:
          type: string
      - description: Timestamp of report generation
        in: path
        name: lastScheduled
        required: true
        schema:
          format: int64
          type: integer
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/ReportGenerationConfigApiModel'
          description: success
        '400':
          description: error
        '404':
          description: not_found
        '405':
          description: method_not_allowed_for_legacy_reports
      security:
      - x-redlock-auth: []
      summary: Get Historical Report Data
      tags:
      - Reports
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /report/{id}/{lastScheduled}/download:
    get:
      description: Downloads the compliance report that has the specified report ID and was generated on the specified timestamp.
      operationId: download-historical-by-id
      parameters:
      - description: Report ID
        in: path
        name: id
        required: true
        schema:
          type: string
      - description: Timestamp of report generation
        in: path
        name: lastScheduled
        required: true
        schema:
          format: int64
          type: integer
      responses:
        '200':
          description: success
        '204':
          description: pending
        '400':
          description: error
        '404':
          description: not_found/error
      security:
      - x-redlock-auth: []
      summary: Download Historical Report
      tags:
      - Reports
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /filter/report/suggest:
    get:
      description: "Returns an object whose key/value pairs identify filter options for compliance posture data. The keys are supported filters, and the corresponding values identify the available and saved filter options.  \n\nThe keys in the response object are the filter names you can use in \n[List Report Overview Filter Autocomplete Suggestions](/prisma-cloud/api/cspm/get-report-posture-filter-options).\n"
      operationId: get-report-filters-and-options
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ReportFilterSuggestion'
          description: success
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Get Report Overview Filters and Options
      tags:
      - Reports
    post:
      description: "Returns the available options for a specific report posture filter. Also supports fuzzy autocomplete search for easier filtering.  \n\nYou can find the available filter names through \n[Get Report Overview Filters and Options request](/prisma-cloud/api/cspm/get-report-filters-and-options). \nThe keys in the response object from that GET request are \nthe available filter names.\n"
      operationId: get-report-posture-filter-options
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/FilterSuggestionModel'
      responses:
        '200':
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/ParsedTableFilter'
          description: success
        '400':
          description: missing_required_parameter / invalid_parameter_value
        '404':
          description: not_found
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: List Report Overview Filter Autocomplete Suggestions
      tags:
      - Reports
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
  /v2/report:
    post:
      description: "Creates a compliance report generation configuration based on the specified parameters. Report generation can be either one-time or recurring.  \n\nYou can use the body parameters to specify whether the report is a one-time report \nor a recurring report. Specify a recurring report by providing a valid \n**target.schedule** body parameter.\n\n**Note:** The `complianceStandardIds` parameter is not applicable to `COMPLIANCE` or `RIS` report types\n"
      operationId: save-report-v2
      requestBody:
        content:
          application/json; charset=UTF-8:
            schema:
              $ref: '#/components/schemas/BaseReportGenerationConfigApiModel'
        description: Model for report generation configuration
        required: true
      responses:
        '200':
          content:
            application/json; charset=UTF-8:
              schema:
                $ref: '#/components/schemas/ReportGenerationConfigApiModel_2'
          description: successful operation
        '400':
          description: missing_required_parameter / invalid_parameter_value
      security:
      - x-redlock-auth: []
      summary: Add Report Config V2
      tags:
      - Reports
    servers:
    - url: https://api.prismacloud.io
    - url: https://api2.prismacloud.io
    - url: https://api3.prismacloud.io
    - url: https://api4.prismacloud.io
    - url: https://api.anz.prismacloud.io
    - url: https://api.eu.prismacloud.io
    - url: https://api2.eu.prismacloud.io
    - url: https://api.gov.prismacloud.io
    - url: https://api.prismacloud.cn
    - url: https://api.ca.prismacloud.io
    - url: https://api.sg.prismacloud.io
    - url: https://api.uk.prismacloud.io
    - url: https://api.ind.prismacloud.io
    - url: https://api.jp.prismacloud.io
    - url: https://api.fr.prismacloud.io
  /reports/summary:
    get:
      operationId: getReportSummary
      summary: Palo Alto Networks Get Incident Summary Report
      description: Returns an aggregated summary of DLP incidents over a specified time period. Includes breakdowns by severity, channel, data pattern, top users, and trend data. Useful for executive reporting and compliance dashboards.
      tags:
      - Reports
      parameters:
      - name: start_time
        in: query
        required: true
        description: Start of reporting period (ISO 8601 format).
        schema:
          type: string
          format: date-time
        example: '2026-09-18T10:51:33Z'
      - name: end_time
        in: query
        required: true
        description: End of reporting period (ISO 8601 format).
        schema:
          type: string
          format: date-time
        example: '2026-11-06T16:58:45Z'
      responses:
        '200':
          description: Incident summary report returned successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IncidentSummary'
              examples:
                GetReportSummary200Example:
                  summary: Default getReportSummary 200 response
                  x-microcks-default: true
                  value:
                    total_incidents: 619
                    open_incidents: 195
                    resolved_incidents: 393
                    by_severity:
                      critical: 30
                      high: 424
                      medium: 932
                      low: 723
                      informational: 986
                    by_channel:
                      web: 358
                      ssl: 453
                      saas: 815
                      email: 786
                      endpoint: 131
                    top_data_patterns:
                    - pattern_name: Production Sensor 38
                      incident_count: 299
                    top_users:
                    - user: example-user
                      incident_count: 609
                    - user: example-user
                      incident_count: 164
                    reporting_period:
                      start_time: '2024-09-15T06:09:00Z'
                      end_time: '2026-07-19T16:10:14Z'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - bearerAuth: []
    servers:
    - url: https://api.dlp.paloaltonetworks.com/v4
      description: Enterprise DLP API production server.
  /report/asset:
    get:
      operationId: getAssetReport
      summary: Palo Alto Networks Get Asset Report
      description: Returns an asset inventory report summarizing all discovered IoT and OT devices. The report includes breakdowns by device category, profile, risk level, and site. Useful for asset inventory management and compliance reporting.
      tags:
      - Reports
      parameters:
      - name: customerid
        in: query
        required: true
        description: Customer tenant identifier.
        schema:
          type: string
        example: '725385'
      - name: offset
        in: query
        description: Pagination offset for results.
        schema:
          type: integer
          default: 0
        example: 0
      - name: pagelength
        in: query
        description: Number of report records to return per page.
        schema:
          type: integer
          default: 100
        example: 100
      responses:
        '200':
          description: Asset report returned successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: Total number of assets in the report.
                  report:
                    $ref: '#/components/schemas/AssetReport'
              examples:
                GetAssetReport200Example:
                  summary: Default getAssetReport 200 response
                  x-microcks-default: true
                  value:
                    total: 9
                    report:
                      total_devices: 646
                      monitored_devices: 724
                      by_category: {}
                      by_risk_level:
                        critical: 372
                        high: 696
                        medium: 301
                        low: 206
                      by_site:
                      - site: HQ-SanFrancisco
                        device_count: 327
                      top_profiles:
                      - profile: Network Printer
                        device_count: 597
                      report_time: '2025-03-06T06:54:38Z'
        '400':
          $ref: '#/components/responses/BadRequest_2'
        '401':
          $ref: '#/components/responses/Unauthorized_2'
        '500':
          $ref: '#/components/responses/InternalServerError'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - keyId: []
        accessKey: []
    servers:
    - url: https://{customer}.iot.paloaltonetworks.com/pub/v4.0
      description: IoT Security API production server.
      variables:
        customer:
          description: Customer-specific tenant identifier.
          default: customer-tenant
  /v1/reports/usage:
    get:
      operationId: getUsageReport
      summary: Palo Alto Networks Get Usage Report
      description: Returns browser usage statistics for the specified time period including active users, session counts, data transferred, blocked threats, and DLP events.
      tags:
      - Reports
      parameters:
      - name: start_date
        in: query
        required: true
        description: Start of the reporting period (ISO 8601).
        schema:
          type: string
          format: date
        example: '2026-10-14'
      - name: end_date
        in: query
        required: true
        description: End of the reporting period (ISO 8601).
        schema:
          type: string
          format: date
        example: '2025-04-14'
      - name: group_by
        in: query
        description: Dimension to group results by.
        schema:
          type: string
          enum:
          - day
          - week
          - month
          - user
          - device
          - policy
        example: week
      responses:
        '200':
          description: Usage report returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsageReport'
              examples:
                GetUsageReport200Example:
                  summary: Default getUsageReport 200 response
                  x-microcks-default: true
                  value:
                    period:
                      start: '2025-02-09'
                      end: '2025-07-27'
                    active_users: 489
                    total_sessions: 336
                    data_transferred_gb: 1.65
                    threats_blocked: 211
                    dlp_events: 404
                    data_points:
                    - timestamp: '2026-04-05T18:42:10Z'
                      active_users: 55
                      sessions: 417
                    - timestamp: '2025-12-14T19:49:02Z'
                      active_users: 469
                      sessions: 309
        '400':
          description: Invalid date range or query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetUsageReport400Example:
                  summary: Default getUsageReport 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetUsageReport401Example:
                  summary: Default getUsageReport 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetUsageReport403Example:
                  summary: Default getUsageReport 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse_3'
              examples:
                GetUsageReport500Example:
                  summary: Default getUsageReport 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Suspicious detected incident malware activity traffic traffic.
                    request_id: a6ecb027-74a1-4efb-9882-cb98e9bab4bf
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
      security:
      - oauth2Bearer: []
    servers:
    - url: https://api.stratacloud.paloaltonetworks.com/aiops/bpa/v1
      description: AIOps for NGFW BPA API production server.
components:
  schemas:
    NameValueIntegerString:
      properties:
        id:
          format: int32
          type: integer
        name:
          type: string
      type: object
    FilterSuggestionModel:
      description: Model for Filter Suggestions
      properties:
        filterName:
          description: Filter name
          type: string
        query:
          description: Case-insensitive fuzzy search autocomplete filter. Includes only items that contain the query as a substring.
          type: string
      required:
      - filterName
      type: object
    ReportGenerationConfigApiModel:
      description: Model for report generation configuration
      properties:
        cloudType:
          description: Cloud type
          enum:
          - aws
          - azure
          - gcp
          - alibaba_cloud
          - oci
          type: string
        complianceStandardDeleted:
          description: Compliance Standard Deleted
          readOnly: true
          type: boolean
        complianceStandardId:
          description: Compliance standard ID
          format: uuid
          readOnly: true
          type: string
        counts:
          allOf:
          - $ref: '#/components/schemas/ComplianceAggregateCount'
          - description: Model for compliance aggregate count
            readOnly: true
        createdBy:
          description: User who created this report
          readOnly: true
          type: string
        createdOn:
          description: Report created on this timestamp
          format: int64
          readOnly: true
          type: integer
        id:
          description: Report ID
          readOnly: true
          type: string
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedOn:
          description: Timestamp of last modification
          format: int64
          readOnly: true
          type: integer
        lastScheduled:
          description: Timestamp of last generated report
          format: int64
          readOnly: true
          type: integer
        locale:
          description: Locale of caller (e.g. en_us, jp). Default is en_us.
          type: string
        name:
          description: Report name
          type: string
        nextSchedule:
          description: Timestamp of next scheduled report
          format: int64
          readOnly: true
          type: integer
        status:
          description: Report generation status
          readOnly: true
          type: string
        target:
          allOf:
          - $ref: '#/components/schemas/ReportTargetModel'
          - description: Report definition
        totalInstanceCount:
          description: Total number of reports for the report ID
          format: int32
          readOnly: true
          type: integer
        type:
          description: Report type. Default is COMPLIANCE.
          enum:
          - COMPLIANCE
          - RIS
          - INVENTORY_OVERVIEW
          - INVENTORY_DETAIL
          type: string
      required:
      - cloudType
      - name
      - target
      type: object
    ParsedTableFilter:
      description: Model for parsed table filter
      properties:
        completeParameters:
          items:
            $ref: '#/components/schemas/UIFilterModel'
          type: array
        links:
          description: JSON query builder links
          type: string
        needsOffsetUpdate:
          description: Needs offset update (for internal use)
          type: boolean
        offset:
          description: Offset within query
          format: int32
          type: integer
        queryRemainder:
          description: Query remainder
          type: string
        suggestions:
          description: List of suggestions
          items:
            type: string
          type: array
        translate:
          description: Translate (for internal use)
          type: boolean
        valid:
          description: Query is valid
          type: boolean
      type: object
    ReportFilterSuggestion:
      description: Model for ReportFilterSuggestion
      properties:
        account.group:
          allOf:
          - $ref: '#/components/schemas/FilterSuggestion'
          - description: Account group
        cloud.account:
          allOf:
          - $ref: '#/components/sc

# --- truncated at 32 KB (59 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-reports-api-openapi.yml