Palo Alto Networks Sandbox API

openapi: 3.2.0
info:
  title: Palo Alto Networks Sandbox API
  version: '1.0'
  description: 'Operations tagged Sandbox across 4 of this provider''s published API definitions: palo-alto-compute-34-03-openapi-34-03-138-sh-openapi.json, palo-alto-compute-openapi-34-04-145-sh-openapi.json, palo-alto-cwpp-34-03-openapi-34-03-138-saas-openapi.json, palo-alto-cwpp-openapi-34-04-145-saas-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: PATH_TO_CONSOLE
tags:
- name: Sandbox
  description: Sandbox. 1 operation in this definition.
  x-description-source: desc/sandbox/sandbox.md
paths:
  /api/v34.03/sandbox:
    post:
      description: 'AddSandboxScanResult. POST /api/v34.03/sandbox on the Sandbox API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/sandbox.ScanResult'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/sandbox.ScanResult'
          description: ScanResult represents sandbox scan results
        default:
          description: ''
      tags:
      - Sandbox
      x-prisma-cloud-target-env:
        permission: sandbox
      operationId: post-sandbox
      summary: AddSandboxScanResult
      x-description-source: desc/sandbox/post.md
  /api/v34.04/sandbox:
    post:
      description: 'AddSandboxScanResult. POST /api/v34.04/sandbox on the Sandbox API. Takes an optional request body. Documented responses: 200.'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/sandbox.ScanResult'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/sandbox.ScanResult'
          description: ScanResult represents sandbox scan results
        default:
          description: ''
      tags:
      - Sandbox
      x-prisma-cloud-target-env:
        permission: sandbox
      operationId: post-sandbox
      summary: AddSandboxScanResult
      x-description-source: desc/sandbox/post.md
components:
  schemas:
    vuln.Application:
      description: Application represents a detected application
      properties:
        installedFromPackage:
          description: 'Indicates that the app was installed as an OS package.

            '
          type: boolean
        knownVulnerabilities:
          description: 'Total number of vulnerabilities for this application.

            '
          type: integer
        layerTime:
          description: 'Image layer to which the application belongs - layer creation time.

            '
          format: int64
          type: integer
        md5:
          description: 'MD5 is the md5sum of the app.

            '
          type: string
        name:
          description: 'Name of the application.

            '
          type: string
        originPackageName:
          description: 'OriginPackageName is the name of the app origin package.

            '
          type: string
        path:
          description: 'Path of the detected application.

            '
          type: string
        rpmModule:
          description: 'RPMModule represents the RPM module in which this application is included.

            '
          type: string
        service:
          description: 'Service indicates whether the application is installed as a service.

            '
          type: boolean
        version:
          description: 'Version of the application.

            '
          type: string
      type: object
    sandbox.SuspiciousFile:
      description: SuspiciousFile represents a suspicious file
      properties:
        containerPath:
          description: 'ContainerPath is the path of the file in the running container.

            '
          type: string
        created:
          description: 'Created indicates if the file was created during runtime.

            '
          type: boolean
        md5:
          description: 'MD5 is the file MD5 hash.

            '
          type: string
        path:
          description: 'Path is the path to the copy of the file.

            '
          type: string
      type: object
    vulnerability.ExploitType:
      description: ExploitType represents the source of an exploit
      enum:
      - - ''
        - exploit-db
        - exploit-windows
        - cisa-kev
      type: string
    shared.ImageTag:
      description: ImageTag represents an image repository and its associated tag or registry digest
      properties:
        digest:
          description: 'Image digest (requires V2 or later registry).

            '
          type: string
        id:
          description: 'ID of the image.

            '
          type: string
        registry:
          description: 'Registry name to which the image belongs.

            '
          type: string
        repo:
          description: 'Repository name to which the image belongs.

            '
          type: string
        tag:
          description: 'Image tag.

            '
          type: string
      type: object
    common.CloudMetadata:
      description: CloudMetadata is the metadata for a cloud provider managed asset (e.g., as part of AWS/GCP/Azure/OCI)
      properties:
        accountID:
          description: 'Cloud account ID.

            '
          type: string
        awsExecutionEnv:
          description: 'AWS execution environment (e.g. EC2/Fargate).

            '
          type: string
        azure:
          $ref: '#/components/schemas/common.AzureMetadata'
        gcp:
          $ref: '#/components/schemas/common.GCPCloudMetadata'
        image:
          description: 'The name of the image the cloud managed host or container is based on.

            '
          type: string
        labels:
          description: 'Cloud provider metadata labels.

            '
          items:
            $ref: '#/components/schemas/common.ExternalLabel'
          type: array
        name:
          description: 'Resource name.

            '
          type: string
        ociTenantID:
          description: 'OCI Tenant ID.

            '
          type: string
        provider:
          $ref: '#/components/schemas/common.CloudProvider'
        region:
          description: 'Resource''s region.

            '
          type: string
        resourceID:
          description: 'Unique ID of the resource.

            '
          type: string
        resourceURL:
          description: 'Server-defined URL for the resource.

            '
          type: string
        type:
          description: 'Instance type.

            '
          type: string
        vmID:
          description: 'Azure unique vm ID.

            '
          type: string
        vmImageID:
          description: 'VMImageID holds the VM instance''s image ID.

            '
          type: string
      type: object
    common.NetworkDeviceIP:
      description: NetworkDeviceIP represents a network device name and address pair
      properties:
        ip:
          description: 'Network device IPv4 address.

            '
          type: string
        name:
          description: 'Network device name.

            '
          type: string
      type: object
    common.Color:
      description: Color is a hexadecimal representation of color code value
      type: string
    sandbox.Event:
      description: Event is a single event in a chain that lead to finding detection
      properties:
        description:
          description: 'Description describes what happened in the event.

            '
          type: string
        time:
          description: 'Time is the time of event detection.

            '
          format: date-time
          type: string
      type: object
    common.ACIMetadata:
      properties:
        containerGroup:
          description: '.

            '
          type: string
      type: object
    secrets.SecretScanMetrics:
      description: SecretScanMetrics represents metrics collected during secret scan
      properties:
        failedScans:
          description: 'FailedScans represents number of failed scans caused by scanner errors.

            '
          format: int64
          type: integer
        foundSecrets:
          description: 'FoundSecrets represents number of detected secrets.

            '
          type: integer
        scanTime:
          description: 'ScanTime represents cumulative secret scan time in microseconds.

            '
          format: int64
          type: integer
        scanTimeouts:
          description: 'ScanTimeouts represents number of failed scans caused by timeout.

            '
          format: int64
          type: integer
        scannedFileSize:
          description: 'ScannedFileSize represents accumulated size of scanned files.

            '
          format: int64
          type: integer
        scannedFiles:
          description: 'ScannedFiles represents number of text files scanned for secrets.

            '
          format: int64
          type: integer
        totalBytes:
          description: 'TotalBytes represents accumulated file size.

            '
          format: int64
          type: integer
        totalFiles:
          description: 'TotalFiles represents number of files read for secrets.

            '
          format: int64
          type: integer
        totalTime:
          description: 'TotalTime represents the total time in microseconds.

            '
          format: int64
          type: integer
        typesCount:
          additionalProperties:
            $ref: '#/components/schemas/int'
          description: 'TypesCount represents distribution of secrets by its type.

            '
          type: object
      type: object
    shared.Packages:
      description: Packages is a collection of packages
      properties:
        pkgs:
          description: 'List of packages.

            '
          items:
            $ref: '#/components/schemas/shared.Package'
          type: array
        pkgsType:
          $ref: '#/components/schemas/packages.Type'
      type: object
    vuln.ComplianceTemplate:
      description: ComplianceTemplate represents the compliance template
      enum:
      - - PCI
        - HIPAA
        - NIST SP 800-190
        - GDPR
        - DISA STIG
      type: string
    shared.FileDetails:
      description: FileDetails contains file details as the file path, hash checksum
      properties:
        md5:
          description: 'Hash sum of the file using md5.

            '
          type: string
        original_file_location:
          description: 'Path of the original file in a case of archive analysis.

            '
          type: string
        path:
          description: 'Path of the file.

            '
          type: string
        sha1:
          description: 'Hash sum of the file using SHA-1.

            '
          type: string
        sha256:
          description: 'Hash sum of the file using SHA256.

            '
          type: string
      type: object
    vuln.SecretType:
      description: SecretType represents a secret type
      enum:
      - - AWS Access Key ID
        - AWS Secret Key
        - AWS MWS Auth Token
        - Azure Storage Account Access Key
        - Azure Service Principal
        - GCP Service Account Auth Key
        - Private Encryption Key
        - Public Encryption Key
        - PEM X509 Certificate Header
        - SSH Authorized Keys
        - Artifactory API Token
        - Artifactory Password
        - Basic Auth Credentials
        - Mailchimp Access Key
        - NPM Token
        - Slack Token
        - Slack Webhook
        - Square OAuth Secret
        - Notion Integration Token
        - Airtable API Key
        - Atlassian Oauth2 Keys
        - CircleCI Personal Token
        - Databricks Authentication Token
        - GitHub Token
        - GitLab Token
        - Google API key
        - Grafana Token
        - Python Package Index Key (PYPI)
        - Typeform API Token
        - Scalr Token
        - Braintree Access Token
        - Braintree Payments Key
        - Paypal Token Key
        - Braintree Payments ID
        - Datadog Client Token
        - ClickUp Personal API Token
        - OpenAI API Key
        - Java DB Connectivity (JDBC)
        - MongoDB
        - .Net SQL Server
      type: string
    common.CloudRunMetadata:
      properties:
        revision:
          description: '.

            '
          type: string
        service:
          description: '.

            '
          type: string
      type: object
    sandbox.FindingType:
      description: FindingType represents a unique sandbox-detected finding type
      enum:
      - - dropper
        - modifiedBinary
        - executableCreation
        - filelessExecutableCreation
        - wildFireMalware
        - verticalPortScan
        - cryptoMiner
        - suspiciousELFHeader
        - kernelModule
        - modifiedBinaryExecution
        - filelessExecution
      type: string
    vulnerability.RiskFactors:
      additionalProperties:
        $ref: '#/components/schemas/string'
      description: RiskFactors maps the existence of vulnerability risk factors
      type: object
    vulnerability.Type:
      description: Type represents the vulnerability type
      enum:
      - - container
        - image
        - host_config
        - daemon_config
        - daemon_config_files
        - security_operations
        - k8s_master
        - k8s_worker
        - k8s_federation
        - linux
        - windows
        - istio
        - serverless
        - custom
        - docker_stig
        - openshift_master
        - openshift_worker
        - application_control_linux
        - gke_worker
        - image_malware
        - host_malware
        - aks_worker
        - eks_worker
        - image_secret
        - host_secret
      type: string
    common.CloudProvider:
      description: CloudProvider specifies the cloud provider name
      enum:
      - - aws
        - azure
        - gcp
        - alibaba
        - oci
        - others
      type: string
    vuln.AllCompliance:
      description: AllCompliance contains data regarding passed compliance checks
      properties:
        compliance:
          description: 'Compliance are all the passed compliance checks.

            '
          items:
            $ref: '#/components/schemas/vuln.Vulnerability'
          type: array
        enabled:
          description: 'Enabled indicates whether passed compliance checks is enabled by policy.

            '
          type: boolean
      type: object
    sandbox.ScanResult:
      description: ScanResult represents sandbox scan results
      properties:
        _id:
          description: 'ID is a unique scan identifier.

            '
          type: string
        collections:
          description: 'Collections to which this result applies.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        connection:
          description: 'Connection is a list of connection events detected during this scan.

            '
          items:
            $ref: '#/components/schemas/sandbox.ConnectionEvent'
          type: array
        dns:
          description: 'DNS is a list of DNS queries detected during this scan.

            '
          items:
            $ref: '#/components/schemas/sandbox.DNSQueryEvent'
          type: array
        entrypoint:
          description: 'Entrypoint is the command executed in the sandbox scan.

            '
          type: string
        filesystem:
          description: 'Filesystem is a list of filesystem events detected during this scan.

            '
          items:
            $ref: '#/components/schemas/sandbox.FilesystemEvent'
          type: array
        findings:
          description: 'Findings are the detected findings during scan.

            '
          items:
            $ref: '#/components/schemas/sandbox.Finding'
          type: array
        image:
          $ref: '#/components/schemas/shared.ImageInfo'
        imageName:
          description: 'ImageName is the image name (e.g. registry/repo:tag).

            '
          type: string
        listening:
          description: 'Listening is a list of listening events detected during this scan.

            '
          items:
            $ref: '#/components/schemas/sandbox.ListeningEvent'
          type: array
        pass:
          description: 'Pass indicates if the scan passed or failed.

            '
          type: boolean
        procs:
          description: 'Procs are the different detected process during this scan.

            '
          items:
            $ref: '#/components/schemas/sandbox.ProcessEvent'
          type: array
        riskScore:
          description: 'RiskScore is the weighted total risk score.

            '
          format: double
          type: number
        scanDuration:
          description: 'ScanDuration is the provided scan duration in nanoseconds.

            '
          format: int64
          type: integer
        scanTime:
          description: 'Start is the scan start time.

            '
          format: date-time
          type: string
        suspiciousFiles:
          description: 'SuspiciousFiles are suspicious files detected during scan.

            '
          items:
            $ref: '#/components/schemas/sandbox.SuspiciousFile'
          type: array
      type: object
    shared.PkgsTimes:
      description: PkgsTimes are the compressed layer times for pkgs of the specific type
      properties:
        pkgTimes:
          description: '.

            '
          items:
            $ref: '#/components/schemas/int64'
          type: array
        pkgsType:
          $ref: '#/components/schemas/packages.Type'
      type: object
    vulnerability.ExploitData:
      description: ExploitData holds information about an exploit
      properties:
        kind:
          $ref: '#/components/schemas/vulnerability.ExploitKind'
        link:
          description: 'Link is a link to information about the exploit.

            '
          type: string
        source:
          $ref: '#/components/schemas/vulnerability.ExploitType'
      type: object
    common.ExternalLabel:
      description: ExternalLabel holds an external label with a source and timestamp
      properties:
        key:
          description: 'Label key.

            '
          type: string
        sourceName:
          description: 'Source name (e.g., for a namespace, the source name can be ''twistlock'').

            '
          type: string
        sourceType:
          $ref: '#/components/schemas/common.ExternalLabelSourceType'
        timestamp:
          description: 'Time when the label was fetched.

            '
          format: date-time
          type: string
        value:
          description: 'Value of the label.

            '
          type: string
      type: object
    string:
      type: string
    common.GCPCloudMetadata:
      properties:
        cloudRun:
          $ref: '#/components/schemas/common.CloudRunMetadata'
      type: object
    sandbox.FindingSeverity:
      description: FindingSeverity represents a finding severity level
      enum:
      - - critical
        - high
        - medium
        - low
      type: string
    sandbox.ConnectionEvent:
      description: ConnectionEvent represents a network connection event
      properties:
        countryCode:
          description: 'CountryCode is the country code for the network IP.

            '
          type: string
        ip:
          description: 'IP is the network IP.

            '
          type: string
        port:
          description: 'Port is the network port.

            '
          type: integer
        process:
          $ref: '#/components/schemas/sandbox.ProcessEvent'
        protocol:
          description: 'Protocol is the transport layer protocol (UDP / TCP).

            '
          type: string
        time:
          description: 'Time is the event time.

            '
          format: date-time
          type: string
      type: object
    vuln.WildFireMalware:
      description: WildFireMalware holds the data for WildFire malicious MD5
      properties:
        md5:
          description: 'MD5 is the hash of the malicious binary.

            '
          type: string
        path:
          description: 'Path is the path to malicious binary.

            '
          type: string
        verdict:
          description: 'Verdict is the malicious source like grayware, malware and phishing.

            '
          type: string
      type: object
    vuln.Secret:
      description: Secret represents a secret found on the scanned workload
      properties:
        group:
          description: 'Group is a group name or ID of owner the file metadata containing the secret.

            '
          type: string
        locationInFile:
          description: 'LocationInFile is the line and offset in the file where the secret was found.

            '
          type: string
        metadataModifiedTime:
          description: 'MetadataModifiedTime is the modification time of the file metadata containing the secret.

            '
          format: int64
          type: integer
        modifiedTime:
          description: 'ModifiedTime is the modification time of the file containing the secret.

            '
          format: int64
          type: integer
        originalFileLocation:
          description: '.

            '
          type: string
        path:
          description: 'Path is the path of the file in which the secret was found.

            '
          type: string
        permissions:
          description: 'Permissions are permission bits of the file metadata containing the secret.

            '
          type: string
        secretID:
          description: 'SecretID is the SHA1 of the secret content.

            '
          type: string
        size:
          description: 'Size is the size in bytes of the file in which the secret was found.

            '
          format: int64
          type: integer
        snippet:
          description: 'Snippet is the partial plain secret.

            '
          type: string
        type:
          $ref: '#/components/schemas/vuln.SecretType'
        user:
          description: 'User is a username or ID of owner the file metadata containing the secret.

            '
          type: string
      type: object
    sandbox.ListeningEvent:
      description: ListeningEvent represents a network listening event
      properties:
        port:
          description: 'Port is the network port.

            '
          type: integer
        process:
          $ref: '#/components/schemas/sandbox.ProcessEvent'
        time:
          description: 'Time is the event time.

            '
          format: date-time
          type: string
      type: object
    vuln.Vulnerability:
      description: Vulnerability is a general schema for vulnerabilities (e.g., for compliance or packages)
      properties:
        applicableRules:
          description: 'Rules applied on the package.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        binaryPkgs:
          description: 'Names of the distro binary package names (packages which are built from the source of the package).

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        block:
          description: 'Indicates if the vulnerability has a block effect (true) or not (false).

            '
          type: boolean
        cause:
          description: 'Additional information regarding the root cause for the vulnerability.

            '
          type: string
        cri:
          description: 'Indicates if this is a CRI-specific vulnerability (true) or not (false).

            '
          type: boolean
        custom:
          description: 'Indicates if the vulnerability is a custom vulnerability (e.g., openscap, sandbox) (true) or not (false).

            '
          type: boolean
        cve:
          description: 'CVE ID of the vulnerability (if applied).

            '
          type: string
        cvss:
          description: 'CVSS score of the vulnerability.

            '
          format: float
          type: number
        description:
          description: 'Description of the vulnerability.

            '
          type: string
        discovered:
          description: 'Specifies the time of discovery for the vulnerability.

            '
          format: date-time
          type: string
        exploit:
          $ref: '#/components/schemas/vulnerability.ExploitType'
        exploits:
          $ref: '#/components/schemas/vulnerability.Exploits'
        fixDate:
          description: 'Date/time when the vulnerability was fixed (in Unix time).

            '
          format: int64
          type: integer
        fixLink:
          description: 'Link to the vendor''s fixed-version information.

            '
          type: string
        functionLayer:
          description: 'Specifies the serverless layer ID in which the vulnerability was discovered.

            '
          type: string
        gracePeriodDays:
          description: 'Number of grace days left for a vulnerability, based on the configured grace period. Nil if no block vulnerability rule applies.

            '
          type: integer
        id:
          description: 'ID of the violation.

            '
          type: integer
        isRPMModule:
          description: 'IsRPMModule indicates whether this vulnerability is specific to an RPM module.

            '
          type: boolean
        layerTime:
          description: 'Date/time of the image layer to which the CVE belongs.

            '
          format: int64
          type: integer
        link:
          description: 'Vendor link to the CVE.

            '
          type: string
        packageName:
          description: 'Name of the package that caused the vulnerability.

            '
          type: string
        packageType:
          $ref: '#/components/schemas/packages.Type'
        packageVersion:
          description: 'Version of the package that caused the vulnerability (or null).

            '
          type: string
        published:
          description: 'Date/time when the vulnerability was published (in Unix time).

            '
          format: int64
          type: integer
        riskFactors:
          $ref: '#/components/schemas/vulnerability.RiskFactors'
        rpmModule:
          description: 'RPMModule specifies the RPM module containing the package affected by this vulnerability.

            '
          type: string
        secret:
          $ref: '#/components/schemas/vuln.Secret'
        severity:
          description: 'Textual representation of the vulnerability''s severity.

            '
          type: string
        status:
          description: 'Vendor status for the vulnerability.

            '
          type: string
        templates:
          description: 'List of templates with which the vulnerability is associated.

            '
          items:
            $ref: '#/components/schemas/vuln.ComplianceTemplate'
          type: array
        text:
          description: 'Description of the violation.

            '
          type: string
        title:
          description: 'Compliance title.

            '
          type: string
        twistlock:
          description: 'Indicates if this is a Twistlock-specific vulnerability (true) or not (false).

            '
          type: boolean
        type:
          $ref: '#/components/schemas/vulnerability.Type'
        vecStr:
          description: 'Textual representation of the metric values used to score the vulnerability.

            '
          type: string
        vulnTagInfos:
          description: 'Tag information for the vulnerability.

            '
          items:
            $ref: '#/components/schemas/vuln.TagInfo'
          type: array
        wildfireMalware:
          $ref: '#/components/schemas/vuln.WildFireMalware'
      type: object
    vuln.Distribution:
      description: Distribution counts the number of vulnerabilities per type
      properties:
        critical:
          description: '.

            '
          type: integer
        high:
          description: '.

            '
          type: integer
        low:
          description: '.

            '
          type: integer
        medium:
          description: '.

            '
          type: integer
        total:
          description: '.

            '
          type: integer
      type: object
    sandbox.FilesystemAccessType:
      description: FilesystemAccessType represents a type of accessing a file
      enum:
      - - open
        - modify
        - create
      type: string
    common.ExternalLabelSourceType:
      description: ExternalLabelSourceType indicates the source of the labels
      enum:
      - - namespace
        - deployment
        - pod
        - aws
        - azure
        - gcp
        - oci
      type: string
    sandbox.FilesystemEvent:
      description: FilesystemEvent represents a filesystem event during sandbox scan
      properties:
        accessType:
          $ref: '#/components/schemas/sandbox.FilesystemAccessType'
        path:
          description: 'Path is the file path.

            '
          type: string
        process:
          $ref: '#/components/schemas/sandbox.ProcessEvent'
        time:
          description: 'Time is the event time.

            '
          format: date-time
          type: string
      type: object
    shared.Binary:
      description: Binary represents a detected binary file (ELF)
      properties:
        altered:
          description: 'Indicates if the binary was installed from a package manager and modified/replaced (true) or not (false).

            '
          type: boolean
        cveCount:
          description: 'Total number of CVEs for this specific binary.

            '
          type: integer
        deps:
          description: 'Third-party package files which are used by the binary.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        fileMode:
          description: 'Represents the file''s mode and permission bits.

            '
          type: integer
        functionLayer:
          description: 'ID of the serverless layer in which the package was discovered.

            '
          type: string
        md5:
          description: 'Md5 hashset of the binary.

            '
          type: string
        missingPkg:
          description: 'Indicates if this binary is not related to any package (true) or not (false).

            '
          type: boolean
        name:
          description: 'Name of the binary.

            '
          type: string
        path:
          description: 'Path is the path of the binary.

            '
          type: string
        pkgRootDir:
          description: 'Path for searching packages used by the binary.

            '
          type: string
        services:
          description: 'Names of services which use the binary.

            '
          items:
            $ref: '#/components/schemas/string'
          type: array
        version:
          description: 'Version of the binary.

            '
          type: string
      type: object
    sandbox.Finding:
      description: Finding represents a finding detected during sandbox scan
      properties:
        description:
          description: 'Description is the finding description.

            '
          type: string
        events:
          description: 'Events are the events that lead to the finding detection.

            '
          items:
            $ref: '#/components/schemas/sandbox.Event'
          type: array
        severity:
          $ref: '#/components/schemas/sandbox.FindingSeverity'
        time:
          description: 'Time is the detection time (time of triggering event).

            '
          format: date-time
          type: string
        type:
          $ref: '#/components/schemas/sandbox.FindingType'
      type: object
    common.ClusterType:
      description: ClusterType is the cluster type
      enum:
      - - AKS
       

# --- truncated at 32 KB (102 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-networks-sandbox-api-openapi.yml