Palo Alto Networks Sandbox API

openapi: 3.2.0
info:
  title: Palo Alto Networks Sandbox API
  x-description-source: desc/intro.md
  version: '1.0'
  description: 'Operations tagged Sandbox across 4 of this provider''s published API definitions: palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json, palo-alto-cwpp-34-03-openapi-34-03-138-saas-openapi.json, palo-alto-cwpp-openapi-34-04-145-saas-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: PATH_TO_CONSOLE
tags:
- name: Sandbox
  description: Sandbox. 1 operation in this definition.
  x-description-source: desc/sandbox/sandbox.md
paths:
  /api/v34.03/sandbox:
    post:
      description: 'AddSandboxScanResult. POST /api/v34.03/sandbox on the Sandbox API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/sandbox.ScanResult'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/sandbox.ScanResult'
          description: ScanResult represents sandbox scan results
        default:
          description: ''
      tags:
      - Sandbox
      x-prisma-cloud-target-env:
        permission: sandbox
      operationId: post-sandbox
      summary: AddSandboxScanResult
      x-description-source: desc/sandbox/post.md
  /api/v34.04/sandbox:
    post:
      description: 'AddSandboxScanResult. POST /api/v34.04/sandbox on the Sandbox API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/sandbox.ScanResult'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/sandbox.ScanResult'
          description: ScanResult represents sandbox scan results
        default:
          description: ''
      tags:
      - Sandbox
      x-prisma-cloud-target-env:
        permission: sandbox
      operationId: post-sandbox
      summary: AddSandboxScanResult
      x-description-source: desc/sandbox/post.md
components:
  schemas:
    shared.CompressedLayerTimes:
      description: CompressedLayerTimes represent the compressed layer times of the image apps and pkgs
      properties:
        appTimes:
          description: '.

            '
          items:
            $ref: '#/components/schemas/int64'
          type: array
        pkgsTimes:
          description: '.

            '
          items:
            $ref: '#/components/schemas/shared.PkgsTimes'
          type: array
      type: object
    sandbox.ConnectionEvent:
      description: ConnectionEvent represents a network connection event
      properties:
        countryCode:
          description: 'CountryCode is the country code for the network IP.

            '
          type: string
        ip:
          description: 'IP is the network IP.

            '
          type: string
        port:
          description: 'Port is the network port.

            '
          type: integer
        process:
          $ref: '#/components/schemas/sandbox.ProcessEvent'
        protocol:
          description: 'Protocol is the transport layer protocol (UDP / TCP).

            '
          type: string
        time:
          description: 'Time is the event time.

            '
          format: date-time
          type: string
      type: object
    vulnerability.ExploitType:
      description: ExploitType represents the source of an exploit
      enum:
      - - ''
        - exploit-db
        - exploit-windows
        - cisa-kev
      type: string
    common.ExternalLabelSourceType:
      description: ExternalLabelSourceType indicates the source of the labels
      enum:
      - - namespace
        - deployment
        - pod
        - aws
        - azure
        - gcp
        - oci
      type: string
    sandbox.FilesystemEvent:
      description: FilesystemEvent represents a filesystem event during sandbox scan
      properties:
        accessType:
          $ref: '#/components/schemas/sandbox.FilesystemAccessType'
        path:
          description: 'Path is the file path.

            '
          type: string
        process:
          $ref: '#/components/schemas/sandbox.ProcessEvent'
        time:
          description: 'Time is the event time.

            '
          format: date-time
          type: string
      type: object
    vuln.ComplianceTemplate:
      description: ComplianceTemplate represents the compliance template
      enum:
      - - PCI
        - HIPAA
        - NIST SP 800-190
        - GDPR
        - DISA STIG
      type: string
    int:
      type: integer
    sandbox.ProcessInfo:
      description: ProcessInfo holds process information
      properties:
        command:
          description: 'Command is the command line.

            '
          type: string
        md5:
          description: 'MD5 is the md5 hash for the process binary.

            '
          type: string
        path:
          description: 'Path is the binary path.

            '
          type: string
        time:
          description: 'Time is the process start time.

            '
          format: date-time
          type: string
        user:
          description: 'User is the username/id.

            '
          type: string
      type: object
    sandbox.ProcessEvent:
      description: ProcessEvent represents a process event during sandbox scan
      properties:
        command:
          description: 'Command is the command line.

            '
          type: string
        md5:
          description: 'MD5 is the md5 hash for the process binary.

            '
          type: string
        parent:
          $ref: '#/components/schemas/sandbox.ProcessInfo'
        path:
          description: 'Path is the binary path.

            '
          type: string
        time:
          description: 'Time is the process start time.

            '
          format: date-time
          type: string
        user:
          description: 'User is the username/id.

            '
          type: string
      type: object
    shared.PkgsTimes:
      description: PkgsTimes are the compressed layer times for pkgs of the specific type
      properties:
        pkgTimes:
          description: '.

            '
          items:
            $ref: '#/components/schemas/int64'
          type: array
        pkgsType:
          $ref: '#/components/schemas/packages.Type'
      type: object
    vulnerability.Type:
      description: Type represents the vulnerability type
      enum:
      - - container
        - image
        - host_config
        - daemon_config
        - daemon_config_files
        - security_operations
        - k8s_master
        - k8s_worker
        - k8s_federation
        - linux
        - windows
        - istio
        - serverless
        - custom
        - docker_stig
        - openshift_master
        - openshift_worker
        - application_control_linux
        - gke_worker
        - image_malware
        - host_malware
        - aks_worker
        - eks_worker
        - image_secret
        - host_secret
      type: string
    sandbox.Event:
      description: Event is a single event in a chain that lead to finding detection
      properties:
        description:
          description: 'Description describes what happened in the event.

            '
          type: string
        time:
          description: 'Time is the time of event detection.

            '
          format: date-time
          type: string
      type: object
    sandbox.FindingSeverity:
      description: FindingSeverity represents a finding severity level
      enum:
      - - critical
        - high
        - medium
        - low
      type: string
    vuln.TagInfo:
      description: TagInfo is the tag info in a specific vulnerability context
      properties:
        color:
          $ref: '#/components/schemas/common.Color'
        comment:
          description: 'Tag comment in a specific vulnerability context.

            '
          type: string
        name:
          description: 'Name of the tag.

            '
          type: string
      type: object
    shared.ImageTag:
      description: ImageTag represents an image repository and its associated tag or registry digest
      properties:
        digest:
          description: 'Image digest (requires V2 or later registry).

            '
          type: string
        id:
          description: 'ID of the image.

            '
          type: string
        registry:
          description: 'Registry name to which the image belongs.

            '
          type: string
        repo:
          description: 'Repository name to which the image belongs.

            '
          type: string
        tag:
          description: 'Image tag.

            '
          type: string
      type: object
    common.NetworkDeviceIP:
      description: NetworkDeviceIP represents a network device name and address pair
      properties:
        ip:
          description: 'Network device IPv4 address.

            '
          type: string
        name:
          description: 'Network device name.

            '
          type: string
      type: object
    common.CloudProvider:
      description: CloudProvider specifies the cloud provider name
      enum:
      - - aws
        - azure
        - gcp
        - alibaba
        - oci
        - others
      type: string
    shared.Package:
      description: Package stores relevant package information
      properties:
        author:
          description: 'Author is the package''s author.

            '
          type: string
        binaryIdx:
          description: 'Indexes of the top binaries which use the package.

            '
          items:
            $ref: '#/components/schemas/int16'
          type: array
        binaryPkgs:
          description: 'Names of the distro binary packages (packages which are built on the source of the package).

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        cveCount:
          description: 'Total number of CVEs for this specific package.

            '
          type: integer
        defaultGem:
          description: 'DefaultGem indicates this is a gem default package (and not a bundled package).

            '
          type: boolean
        files:
          description: 'List of package-related files and their hashes. Only included when the appropriate scan option is set.

            '
          items:
            $ref: '#/components/schemas/shared.FileDetails'
          type: array
        functionLayer:
          description: 'ID of the serverless layer in which the package was discovered.

            '
          type: string
        goPkg:
          description: 'GoPkg indicates this is a Go package (and not module).

            '
          type: boolean
        isRPMModule:
          description: 'IsRPMModule indicates whether this package data represents an RPM module.

            '
          type: boolean
        jarIdentifier:
          description: 'JarIdentifier holds an additional identification detail of a JAR package.

            '
          type: string
        layerTime:
          description: 'Image layer to which the package belongs (layer creation time).

            '
          format: int64
          type: integer
        license:
          description: 'License information for the package.

            '
          type: string
        md5:
          description: 'MD5SUM is the md5sum of the package - currently only relevant for go main modules.

            '
          type: string
        name:
          description: 'Name of the package.

            '
          type: string
        originPackageName:
          description: 'OriginPackageName is the name of the third-party origin package.

            '
          type: string
        osPackage:
          description: 'OSPackage indicates that a python/java package was installed as an OS package.

            '
          type: boolean
        path:
          description: 'Full package path (e.g., JAR or Node.js package path).

            '
          type: string
        purl:
          description: 'PURL is a package URL identifier for this package.

            '
          type: string
        rpmModule:
          description: 'RPMModule represents the RPM module in which this package is included.

            '
          type: string
        securityRepoPkg:
          description: 'SecurityRepoPkg determines if this package is available in a security repository.

            '
          type: boolean
        symbols:
          description: 'Symbols contains names of vulnerable functions that are linked in the executable binary, empty if the entire package is vulnerable.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        version:
          description: 'Package version.

            '
          type: string
      type: object
    vuln.SecretType:
      description: SecretType represents a secret type
      enum:
      - - AWS Access Key ID
        - AWS Secret Key
        - AWS MWS Auth Token
        - Azure Storage Account Access Key
        - Azure Service Principal
        - GCP Service Account Auth Key
        - Private Encryption Key
        - Public Encryption Key
        - PEM X509 Certificate Header
        - SSH Authorized Keys
        - Artifactory API Token
        - Artifactory Password
        - Basic Auth Credentials
        - Mailchimp Access Key
        - NPM Token
        - Slack Token
        - Slack Webhook
        - Square OAuth Secret
        - Notion Integration Token
        - Airtable API Key
        - Atlassian Oauth2 Keys
        - CircleCI Personal Token
        - Databricks Authentication Token
        - GitHub Token
        - GitLab Token
        - Google API key
        - Grafana Token
        - Python Package Index Key (PYPI)
        - Typeform API Token
        - Scalr Token
        - Braintree Access Token
        - Braintree Payments Key
        - Paypal Token Key
        - Braintree Payments ID
        - Datadog Client Token
        - ClickUp Personal API Token
        - OpenAI API Key
        - Java DB Connectivity (JDBC)
        - MongoDB
        - .Net SQL Server
      type: string
    common.Color:
      description: Color is a hexadecimal representation of color code value
      type: string
    packages.Type:
      description: Type describes the package type
      enum:
      - - nodejs
        - gem
        - python
        - jar
        - package
        - windows
        - binary
        - nuget
        - go
        - app
        - unknown
      type: string
    vuln.Application:
      description: Application represents a detected application
      properties:
        installedFromPackage:
          description: 'Indicates that the app was installed as an OS package.

            '
          type: boolean
        knownVulnerabilities:
          description: 'Total number of vulnerabilities for this application.

            '
          type: integer
        layerTime:
          description: 'Image layer to which the application belongs - layer creation time.

            '
          format: int64
          type: integer
        md5:
          description: 'MD5 is the md5sum of the app.

            '
          type: string
        name:
          description: 'Name of the application.

            '
          type: string
        originPackageName:
          description: 'OriginPackageName is the name of the app origin package.

            '
          type: string
        path:
          description: 'Path of the detected application.

            '
          type: string
        rpmModule:
          description: 'RPMModule represents the RPM module in which this application is included.

            '
          type: string
        service:
          description: 'Service indicates whether the application is installed as a service.

            '
          type: boolean
        version:
          description: 'Version of the application.

            '
          type: string
      type: object
    shared.FileDetails:
      description: FileDetails contains file details as the file path, hash checksum
      properties:
        md5:
          description: 'Hash sum of the file using md5.

            '
          type: string
        original_file_location:
          description: 'Path of the original file in a case of archive analysis.

            '
          type: string
        path:
          description: 'Path of the file.

            '
          type: string
        sha1:
          description: 'Hash sum of the file using SHA-1.

            '
          type: string
        sha256:
          description: 'Hash sum of the file using SHA256.

            '
          type: string
      type: object
    vuln.Vulnerability:
      description: Vulnerability is a general schema for vulnerabilities (e.g., for compliance or packages)
      properties:
        applicableRules:
          description: 'Rules applied on the package.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        binaryPkgs:
          description: 'Names of the distro binary package names (packages which are built from the source of the package).

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        block:
          description: 'Indicates if the vulnerability has a block effect (true) or not (false).

            '
          type: boolean
        cause:
          description: 'Additional information regarding the root cause for the vulnerability.

            '
          type: string
        cri:
          description: 'Indicates if this is a CRI-specific vulnerability (true) or not (false).

            '
          type: boolean
        custom:
          description: 'Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).

            '
          type: boolean
        cve:
          description: 'CVE ID of the vulnerability (if applied).

            '
          type: string
        cvss:
          description: 'CVSS score of the vulnerability.

            '
          format: float
          type: number
        description:
          description: 'Description of the vulnerability.

            '
          type: string
        discovered:
          description: 'Specifies the time of discovery for the vulnerability.

            '
          format: date-time
          type: string
        exploit:
          $ref: '#/components/schemas/vulnerability.ExploitType'
        exploits:
          $ref: '#/components/schemas/vulnerability.Exploits'
        fixDate:
          description: 'Date/time when the vulnerability was fixed (in Unix time).

            '
          format: int64
          type: integer
        fixLink:
          description: 'Link to the vendor''s fixed-version information.

            '
          type: string
        functionLayer:
          description: 'Specifies the serverless layer ID in which the vulnerability was discovered.

            '
          type: string
        gracePeriodDays:
          description: 'Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.

            '
          type: integer
        id:
          description: 'ID of the violation.

            '
          type: integer
        isRPMModule:
          description: 'IsRPMModule indicates whether this vulnerability is specific to an RPM module.

            '
          type: boolean
        layerTime:
          description: 'Date/time of the image layer to which the CVE belongs.

            '
          format: int64
          type: integer
        link:
          description: 'Vendor link to the CVE.

            '
          type: string
        packageName:
          description: 'Name of the package that caused the vulnerability.

            '
          type: string
        packageType:
          $ref: '#/components/schemas/packages.Type'
        packageVersion:
          description: 'Version of the package that caused the vulnerability (or null).

            '
          type: string
        published:
          description: 'Date/time when the vulnerability was published (in Unix time).

            '
          format: int64
          type: integer
        riskFactors:
          $ref: '#/components/schemas/vulnerability.RiskFactors'
        rpmModule:
          description: 'RPMModule specifies the RPM module containing the package affected by this vulnerability.

            '
          type: string
        secret:
          $ref: '#/components/schemas/vuln.Secret'
        severity:
          description: 'Textual representation of the vulnerability''s severity.

            '
          type: string
        status:
          description: 'Vendor status for the vulnerability.

            '
          type: string
        templates:
          description: 'List of templates with which the vulnerability is associated.

            '
          items:
            $ref: '#/components/schemas/vuln.ComplianceTemplate'
          type: array
        text:
          description: 'Description of the violation.

            '
          type: string
        title:
          description: 'Compliance title.

            '
          type: string
        twistlock:
          description: 'Indicates if this is a Twistlock-specific vulnerability (true) or not (false).

            '
          type: boolean
        type:
          $ref: '#/components/schemas/vulnerability.Type'
        vecStr:
          description: 'Textual representation of the metric values used to score the vulnerability.

            '
          type: string
        vulnTagInfos:
          description: 'Tag information for the vulnerability.

            '
          items:
            $ref: '#/components/schemas/vuln.TagInfo'
          type: array
        wildfireMalware:
          $ref: '#/components/schemas/vuln.WildFireMalware'
      type: object
    common.ExternalLabel:
      description: ExternalLabel holds an external label with a source and timestamp
      properties:
        key:
          description: 'Label key.

            '
          type: string
        sourceName:
          description: 'Source name (e.g., for a namespace, the source name can be ''twistlock'').

            '
          type: string
        sourceType:
          $ref: '#/components/schemas/common.ExternalLabelSourceType'
        timestamp:
          description: 'Time when the label was fetched.

            '
          format: date-time
          type: string
        value:
          description: 'Value of the label.

            '
          type: string
      type: object
    common.AzureMetadata:
      properties:
        aci:
          $ref: '#/components/schemas/common.ACIMetadata'
        resourceGroup:
          description: '.

            '
          type: string
      type: object
    common.CloudRunMetadata:
      properties:
        revision:
          description: '.

            '
          type: string
        service:
          description: '.

            '
          type: string
      type: object
    shared.Image:
      description: Image represents a container image
      properties:
        created:
          description: 'Date/time when the image was created.

            '
          format: date-time
          type: string
        entrypoint:
          description: 'Combined entrypoint of the image (entrypoint + CMD).

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        env:
          description: 'Image environment variables.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        healthcheck:
          description: 'Indicates if health checks are enabled (true) or not (false).

            '
          type: boolean
        history:
          description: 'Holds the image history.

            '
          items:
            $ref: '#/components/schemas/shared.ImageHistory'
          type: array
        id:
          description: 'ID of the image.

            '
          type: string
        labels:
          additionalProperties:
            $ref: '#/components/schemas/string'
          description: 'Image labels.

            '
          type: object
        layers:
          description: 'Image filesystem layers.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        os:
          description: 'Image os type.

            '
          type: string
        repoDigest:
          description: 'Image repo digests.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        repoTags:
          description: 'Image repo tags.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        user:
          description: 'Image user.

            '
          type: string
        workingDir:
          description: 'Base working directory of the image.

            '
          type: string
      type: object
    common.ClusterType:
      description: ClusterType is the cluster type
      enum:
      - - AKS
        - ECS
        - EKS
        - GKE
        - Kubernetes
      type: string
    shared.ImageHistory:
      description: ImageHistory represent a layer in the image's history
      properties:
        baseLayer:
          description: 'Indicates if this layer originated from the base image (true) or not (false).

            '
          type: boolean
        created:
          description: 'Date/time when the image layer was created.

            '
          format: int64
          type: integer
        emptyLayer:
          description: 'Indicates if this instruction didn''t create a separate layer (true) or not (false).

            '
          type: boolean
        id:
          description: 'ID of the layer.

            '
          type: string
        instruction:
          description: 'Docker file instruction and arguments used to create this layer.

            '
          type: string
        sizeBytes:
          description: 'Size of the layer (in bytes).

            '
          format: int64
          type: integer
        tags:
          description: 'Holds the image tags.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        vulnerabilities:
          description: 'Vulnerabilities which originated from this layer.

            '
          items:
            $ref: '#/components/schemas/vuln.Vulnerability'
          type: array
      type: object
    sandbox.Finding:
      description: Finding represents a finding detected during sandbox scan
      properties:
        description:
          description: 'Description is the finding description.

            '
          type: string
        events:
          description: 'Events are the events that lead to the finding detection.

            '
          items:
            $ref: '#/components/schemas/sandbox.Event'
          type: array
        severity:
          $ref: '#/components/schemas/sandbox.FindingSeverity'
        time:
          description: 'Time is the detection time (time of triggering event).

            '
          format: date-time
          type: string
        type:
          $ref: '#/components/schemas/sandbox.FindingType'
      type: object
    shared.Packages:
      description: Packages is a collection of packages
      properties:
        pkgs:
          description: 'List of packages.

            '
          items:
            $ref: '#/components/schemas/shared.Package'
          type: array
        pkgsType:
          $ref: '#/components/schemas/packages.Type'
      type: object
    common.CloudMetadata:
      description: CloudMetadata is the metadata for a cloud provider managed asset (e.g., as part of AWS/GCP/Azure/OCI)
      properties:
        accountID:
          description: 'Cloud account ID.

            '
          type: string
        awsExecutionEnv:
          description: 'AWS execution environment (e.g. EC2/Fargate).

            '
          type: string
        azure:
          $ref: '#/components/schemas/common.AzureMetadata'
        gcp:
          $ref: '#/components/schemas/common.GCPCloudMetadata'
        image:
          description: 'The name of the image the cloud managed host or container is based on.

            '
          type: string
        labels:
          description: 'Cloud provider metadata labels.

            '
          items:
            $ref: '#/components/schemas/common.ExternalLabel'
          type: array
        name:
          description: 'Resource name.

            '
          type: string
        ociTenantID:
          description: 'OCI Tenant ID.

            '
          type: string
        provider:
          $ref: '#/components/schemas/common.CloudProvider'
        region:
          description: 'Resource''s region.

            '
          type: string
        resourceID:
          description: 'Unique ID of the resource.

            '
          type: string
        resourceURL:
          description: 'Server-defined URL for the resource.

            '
          type: string
        type:
          description: 'Instance type.

            '
          type: string
        vmID:
          description: 'Azure unique vm ID.

            '
          type: string
        vmImageID:
          description: 'VMImageID holds the VM instance''s image ID.

            '
          type: string
      type: object
    shared.Binary:
      description: Binary represents a detected binary file (ELF)
      properties:
        altered:
          description: 'Indicates if the binary was installed from a package manager and modified/replaced (true) or not (false).

            '
          type: boolean
        cveCount:
          description: 'Total number of CVEs for this specific binary.

            '
          type: integer
        deps:
          description: 'Third-party package files which are used by the binary.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        fileMode:
          description: 'Represents the file''s mode and permission bits.

            '
          type: integer
        functionLayer:
          description: 'ID of the serverless layer in which the package was discovered.

            '
          type: string
        md5:
          description: 'Md5 hashset of the binary.

            '
          type: string
        missingPkg:
          description: 'Indicates if this binary is not related to any package (true) or not (false).

            '
          type: boolean
        name:
          description: 'Name of the binary.

            '
          type: string
        path:
          description: 'Path is the path of the binary.

            '
          type: string
        pkgRootDir:
          description: 'Path for searching packages used by the binary.

            '
          type: string
        services:
          description: 'Names of services which use the binary.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        version:
          description: 'Version of the binary.

            '
          type: string
      type: object
    vulnerability.RiskFactors:
      additionalProperties:
        $ref: '#/components/schemas/string'
      description: RiskFactors maps the existence of vulnerability risk factors
      type: object
    sandbox.ScanResult:
      description: ScanResult represents sandbox scan results
      properties:
        _id:
          description: 'ID is a unique scan identifier.

            '
          type: string
        collections:
          description: 'Collections to which this result applies.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        connection:
          description: 'Connection is a list of connection events detected during this scan.

            '
          items:
            $ref: '#/components/schemas/sandbox.ConnectionEvent'
          type

# --- truncated at 32 KB (102 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-sandbox-api-openapi.yml