Palo Alto Networks SaaS Instance API

openapi: 3.2.0
info:
  title: Incident Security Service Posture Management SaaS Instance API
  version: '1.0'
  description: Endpoint to retrieve Identity Posture Security information This Open API spec file was created on July 01, 2025. © 2025 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at [https://www.paloaltonetworks.com/company/trademarks.html](https://www.paloaltonetworks.com/company/trademarks.html). All other marks mentioned herein may be trademarks of their respective companies.
servers:
- url: https://api.sase.paloaltonetworks.com
- url: https://api.strata.paloaltonetworks.com
tags:
- name: SaaS Instance
paths:
  /sspm/identity/v1/saas_instances:
    get:
      summary: Get SaaS Instance list
      description: "Retrieve a list of software as a service (SaaS) instances configured for the tenant. \nEach instance includes metadata such as application type and display name."
      operationId: saas_instances_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseSaaSInstanceInfo'
        '404':
          description: Not Found
      parameters:
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - SaaS Instance
  /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts:
    get:
      summary: Get SaaS account list
      description: "Retrieve a list of user accounts associated with the specified software as a service (SaaS) instance. \nThe response includes account metadata such as roles, login activity, and status for each user."
      operationId: saas_instances_saas_accounts_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseSaaSAccount'
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
      - name: page
        in: query
        schema:
          format: int32
          type: integer
      - name: sortBy
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - SaaS Instance
  /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/count:
    get:
      summary: Get SaaS account count
      description: "Return the number of user accounts associated with the specified software as a service (SaaS) instance. \nYou can apply filters to refine the account count based on criteria such as roles, status, or account types."
      operationId: saas_instances_saas_accounts_count_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                additionalProperties:
                  format: int64
                  type: integer
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - SaaS Instance
  /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/csv_report:
    post:
      summary: Generate SaaS account CSV report
      description: "Generate a CSV report of accounts linked to the specified software as a service (SaaS) instance. \nThis report helps in auditing user presence and roles within the application."
      operationId: saas_instances_saas_accounts_count_csv_report_post
      responses:
        '201':
          description: Created
        '400':
          description: Bad Request
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: sortBy
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - SaaS Instance
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DownloadCsvRequest'
  /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_activity:
    get:
      summary: Get SaaS activity logs
      description: "Retrieve a list of activity logs for the specified software as a service (SaaS) instance. \nLogs include user actions, accessed resources, locations, and timestamps to support security auditing and monitoring."
      operationId: saas_instances_saas_activity_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseSaaSActivity'
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
      - name: page
        in: query
        schema:
          format: int32
          type: integer
      - name: sortBy
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - SaaS Instance
  /sspm/identity/v1/{saasInstanceId}/tickets:
    get:
      summary: Get SaaS Instance tickets
      description: Retrieve a list of tickets associated with the specified software as a service (SaaS) instance. Tickets track security findings, misconfigurations, or other remediation needs.
      operationId: saas_instances_tickets_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseTicket'
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
      - name: filter
        in: query
        schema:
          type: string
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
      - name: page
        in: query
        schema:
          format: int32
          type: integer
      - name: sortBy
        in: query
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - SaaS Instance
    post:
      summary: Create SaaS instance ticket
      description: "Create a new ticket for the specified software as a service (SaaS) instance. \nTickets help track remediation efforts for flagged issues or vulnerabilities."
      operationId: saas_instances_tickets_post
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Ticket'
        '400':
          description: Bad Request
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - SaaS Instance
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTicketRequest'
    delete:
      summary: Delete SaaS instance tickets
      description: "Delete or unlink one or more tickets associated with the specified software as a service (SaaS) instance. \nThis action is typically used to close resolved or invalid issues."
      operationId: saas_instances_tickets_delete
      responses:
        '204':
          description: No Content
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - SaaS Instance
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UnlinkTicketRequest'
  /sspm/identity/v1/{saasInstanceId}/tickets/{ticketKey}/issues:
    get:
      summary: Get ticket issues
      description: "Retrieve a list of issues linked to a specific ticket for the given software as a service (SaaS) instance. \nThis helps in tracking and managing remediation or investigation items."
      operationId: saas_instances_tickets_issues_get
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListResponseMapStringObject'
        '404':
          description: Not Found
      parameters:
      - name: saasInstanceId
        in: path
        required: true
        schema:
          type: string
      - name: ticketKey
        in: path
        required: true
        schema:
          type: string
      - name: limit
        in: query
        schema:
          format: int32
          type: integer
      - name: page
        in: query
        schema:
          format: int32
          type: integer
      - name: x-ps-tenant
        in: header
        schema:
          type: string
      tags:
      - SaaS Instance
components:
  schemas:
    UnlinkTicketRequest:
      required:
      - id
      - feature
      type: object
      properties:
        id:
          type: string
        resourceIds:
          type: array
          items:
            type: string
        feature:
          $ref: '#/components/schemas/Feature'
    ListResponseMapStringObject:
      type: object
      properties:
        total:
          format: int64
          type: integer
        items:
          type: array
          items:
            type: object
    Feature:
      enum:
      - ENROLLMENT
      - ACTIVITY
      - LOGOUT
      - IDENTITY_NHI
      - IDENTITY_ACTIVITY
      type: string
    ListResponseSaaSInstanceInfo:
      type: object
      properties:
        total:
          format: int64
          type: integer
        items:
          type: array
          items:
            $ref: '#/components/schemas/SaaSInstanceInfo'
    Instant:
      format: date-time
      type: string
      example: 2022-03-10 16:15:50+00:00
    ListResponseSaaSActivity:
      type: object
      properties:
        total:
          format: int64
          type: integer
        items:
          type: array
          items:
            $ref: '#/components/schemas/SaaSActivity'
    Ticket:
      type: object
      properties:
        id:
          type: string
        tenant:
          type: string
        saasInstanceId:
          type: string
        resourceIds:
          type: string
        feature:
          type: string
        users:
          type: string
        integrationId:
          type: string
        type:
          type: string
        ticketKey:
          type: string
        ticketUrl:
          type: string
        summary:
          type: string
        createdAt:
          $ref: '#/components/schemas/Instant'
    SaaSActivity:
      type: object
      properties:
        id:
          type: string
        userId:
          type: string
        tenant:
          type: string
        saasInstanceId:
          type: string
        appType:
          type: string
        resourceType:
          type: string
        resourceName:
          type: string
        activityType:
          type: string
        clientIP:
          type: string
        location:
          type: string
        userAgent:
          type: string
        summary:
          type: string
        rawData:
          type: string
        activityDateTime:
          $ref: '#/components/schemas/Instant'
        createdAt:
          $ref: '#/components/schemas/Instant'
    DownloadCsvRequest:
      required:
      - userFullName
      - userEmail
      - service
      type: object
      properties:
        userFullName:
          type: string
        userEmail:
          type: string
        service:
          type: string
    CreateTicketRequest:
      required:
      - resourceIds
      - feature
      - integrationId
      - type
      - issueTypeId
      - summary
      type: object
      properties:
        resourceIds:
          type: array
          items:
            type: string
        feature:
          $ref: '#/components/schemas/Feature'
        integrationId:
          type: string
        type:
          type: string
        issueTypeId:
          type: string
        summary:
          type: string
        description:
          type: string
        settings:
          type: object
          additionalProperties:
            type: string
    ListResponseSaaSAccount:
      type: object
      properties:
        total:
          format: int64
          type: integer
        items:
          type: array
          items:
            $ref: '#/components/schemas/SaaSAccount'
    ListResponseTicket:
      type: object
      properties:
        total:
          format: int64
          type: integer
        items:
          type: array
          items:
            $ref: '#/components/schemas/Ticket'
    SaaSInstanceInfo:
      type: object
      properties:
        displayName:
          type: string
        saasInstanceId:
          type: string
        appType:
          type: string
    SaaSAccount:
      type: object
      properties:
        id:
          type: string
        saasProviderId:
          type: string
        tenant:
          type: string
        saasInstanceId:
          type: string
        jobId:
          type: string
        appId:
          type: string
        appType:
          type: string
        accountType:
          type: string
        accountName:
          type: string
        email:
          type: string
        isLocal:
          type: boolean
        isOrphaned:
          type: boolean
        isElevated:
          type: boolean
        ticketKey:
          type: string
        ticketUrl:
          type: string
        roles:
          type: string
        creator:
          type: string
        linkedHumanAccounts:
          type: string
        saasProviderNhiName:
          type: string
        lastModifiedTime:
          $ref: '#/components/schemas/Instant'
        lastLoginTime:
          $ref: '#/components/schemas/Instant'
        isNonHuman:
          type: boolean
        createdTime:
          $ref: '#/components/schemas/Instant'
        latestScanTime:
          $ref: '#/components/schemas/Instant'
        lastCredentialsRotated:
          $ref: '#/components/schemas/Instant'
        rotatedBy:
          type: string
        githubOrgName:
          type: string
        credentialsExpiresAt:
          $ref: '#/components/schemas/Instant'