Palo Alto Networks Suppressions API
The Suppressions API from Palo Alto Networks — 4 operation(s) for suppressions.
OpenAPI Specification
openapi: 3.2.0
info:
contact: {}
description: "The Suppressions endpoints are listed below. \n"
title: Prisma Cloud API Overview Suppressions API
version: Latest
servers:
- url: https://api.prismacloud.io
tags:
- name: Suppressions
paths:
/code/api/v1/suppressions:
get:
description: 'Every suppression rule has a type indicating scope (aka suppression type) and details on the scope. Resources answering the scope of the suppression will not return an error on a misconfigured resource and will appear as "suppressed".
The possible suppression scopes are:
Policy - The entire policy is turned off.
Account - Resources in specific accounts or repositories are suppressed.
Tags - Resource with specific set tags are suppressed.
Resources- Resource by specific IDs are suppressed.'
operationId: getSuppressions
parameters: []
responses:
'200':
content:
application/json:
examples:
Example 1:
value:
- comment: Policy is irrelevant.
creationDate: '2020-10-15T12:46:49.592Z'
id: 2684013d-43d0-401d-9bf2-74dc4df76386
policyId: BC_GCP_LOGGING_1
suppressionType: Policy
- comment: Ignored.
creationDate: '2021-01-08T23:00:47.674Z'
id: e1272e30-e231-4beb-b960-1bcb24c2834d
policyId: BC_GCP_GCS_2
suppressionType: Tags
tags:
- key: team
value: knights
- accountIds: null
comment: No justification comment provided.
creationDate: '2020-12-24T13:22:20.086Z'
id: 13a5befb-ccaf-4bf8-83af-b1d8fd5c89f6
policyId: BC_AZR_STORAGE_1
suppressionType: Accounts
- comment: Dev env resources.
creationDate: '2020-09-18T08:09:25.803Z'
id: b48476c4-062a-4091-a48d-040c14d7e809
policyId: acme_AWS_1600118884127
resources:
resourceId: /terraform/aws/ec2.tf:aws_instance.web_host
suppressionType: Resources
schema:
items:
$ref: '#/components/schemas/LegacySuppression'
type: array
description: Returns all the suppressions
security:
- CustomAuthorizer: []
summary: List Suppression Rules
tags:
- Suppressions
x-codeSamples:
- lang: Python + Requests
source: 'import requests
url = "https://api.prismacloud.io/code/api/v1/suppressions"
headers = {"authorization": "REPLACE_KEY_VALUE"}
response = requests.request("GET", url, headers=headers)
print(response.text)'
- lang: Shell + Curl
source: "curl --request GET \\\n --url https://api.prismacloud.io/code/api/v1/suppressions \\\n --header 'authorization: REPLACE_KEY_VALUE'"
/code/api/v1/suppressions/{policyId}:
post:
description: 'Prisma Cloud Application Security supports advanced Suppression rule settings in order to make policy management easier by dismissing or snoozing errors
(using time-bounded suppression rules) that are irrelevant in your cloud and code environments.
Suppression can be applied at various levels: for all cases (Disable Policy), for a specific Source,
To use the API request, add your token to the header.
Use this API function to create a new Prisma Cloud Application Security Suppression rule that will be associated with the policyId included in the request.
The input includes comment (Justification), SuppressionType (Resources (by default), Accounts, Policy, or Tags) and expirationTime (in Unix epoch time).
* for Resources - resources - array of { id, accountId }
* for Accounts - accountIds - array of strings
* for Policy - nothing
* for Tags - tags - array of { key, value }
The output will be -
* success response - 200 , suppressionId
* error response - 400, “Couldn''t save suppression”'
operationId: createSuppression
parameters:
- in: path
name: policyId
required: true
schema:
type: string
requestBody:
content:
application/json:
examples:
Example 1:
value:
comment: Policy is irrelevant.
expirationTime: 1834303033687
origin: Platform
suppressionType: Policy
Example 2:
value:
comment: Ignored.
expirationTime: 1834303033687
origin: Platform
suppressionType: Tags
tags:
- key: team
value: knights
Example 3:
value:
accountIds: null
comment: No justification comment provided.
expirationTime: 1834303033687
origin: Platform
suppressionType: Accounts
Example 4:
value:
comment: Dev env resources.
expirationTime: 1834303033687
origin: Platform
resources:
id: /terraform/aws/ec2.tf:aws_instance.web_host
suppressionType: Resources
schema:
$ref: '#/components/schemas/SuppressionCreate'
required: true
responses:
'200':
content:
application/json:
schema:
type: string
description: Suppression ID
'422':
description: Request arguments validation error
security:
- CustomAuthorizer: []
summary: Create New Suppression by Policy ID
tags:
- Suppressions
x-codeSamples:
- lang: Python + Requests
source: "import requests\n\nurl = \"https://api.prismacloud.io/code/api/v1/suppressions/{policyId}\"\n\npayload = {\n \"comment\": \"string\",\n \"expirationTime\": 0,\n \"origin\": \"string\",\n \"resources\": [\n {\n \"accountId\": \"string\",\n \"id\": \"string\"\n }\n ],\n \"suppressionType\": \"Resources\"\n}\nheaders = {\n \"content-type\": \"application/json\",\n \"authorization\": \"REPLACE_KEY_VALUE\"\n}\n\nresponse = requests.request(\"POST\", url, json=payload, headers=headers)\n\nprint(response.text)"
- lang: Shell + Curl
source: "curl --request POST \\\n --url https://api.prismacloud.io/code/api/v1/suppressions/{policyId} \\\n --header 'authorization: REPLACE_KEY_VALUE' \\\n --header 'content-type: application/json' \\\n --data '{\"comment\":\"string\",\"expirationTime\":0,\"origin\":\"string\",\"resources\":[{\"accountId\":\"string\",\"id\":\"string\"}],\"suppressionType\":\"Resources\"}'"
/code/api/v1/suppressions/{policyId}/justifications/{suppressionId}:
put:
description: 'Prisma Cloud Application Security supports advanced Suppression rule settings in order to make policy management easier by dismissing or snoozing errors
(using time-bounded suppression rules) that are irrelevant in your cloud and code environments.
Suppression can be applied at various levels: for all cases (Disable Policy), for a specific Source, for a Specific Resource or by tag.
To use the API request, add your token to the header.
Use this API function to update an existing Prisma Cloud Application Security Suppression rule for the given policyId and suppressionId mentioned in the path.
The input includes comment (Justification for such rule), SuppressionType (Resources (by default), Accounts, Policy OR Tags)
and expirationTime (in Unix epoch time).
* for Resources - resources - array of { id, accountId }
* for Accounts - accountIds - array of strings
* for Policy - nothing
* for Tags - tags - array of { key, value }
The output will be -
* Success - 200, suppressionId
* Error - 400, Couldn''t update suppression ${suppressionId}
Use the example below as a reference for configuring the API request body for saving new suppression rules.'
operationId: updateSuppression
parameters:
- in: path
name: policyId
required: true
schema:
type: string
- in: path
name: suppressionId
required: true
schema:
type: string
requestBody:
content:
application/json:
examples:
Example 1:
value:
comment: Policy is irrelevant.
expirationTime: 1834303033687
origin: Platform
suppressionType: Policy
Example 2:
value:
comment: Ignored.
expirationTime: 1834303033687
origin: Platform
suppressionType: Tags
tags:
- key: team
value: knights
Example 3:
value:
accountIds: null
comment: No justification comment provided.
expirationTime: 1834303033687
origin: Platform
suppressionType: Accounts
Example 4:
value:
comment: Dev env resources.
expirationTime: 1834303033687
origin: Platform
resources:
id: /terraform/aws/ec2.tf:aws_instance.web_host
suppressionType: Resources
schema:
$ref: '#/components/schemas/SuppressionCreate'
required: true
responses:
'200':
content:
application/json:
schema:
type: string
description: Suppression ID
'400':
description: Update suppression failed due to bad request
'401':
description: Unauthorized to update suppression
'422':
description: Request arguments validation error
'500':
description: Failed to update suppression do to internal server error
security:
- CustomAuthorizer: []
summary: Update Suppression by Policy ID and Suppression ID
tags:
- Suppressions
x-codeSamples:
- lang: Python + Requests
source: "import requests\n\nurl = \"https://api.prismacloud.io/code/api/v1/suppressions/{policyId}/justifications/{suppressionId}\"\n\npayload = {\n \"comment\": \"string\",\n \"expirationTime\": 0,\n \"origin\": \"string\",\n \"resources\": [\n {\n \"accountId\": \"string\",\n \"id\": \"string\"\n }\n ],\n \"suppressionType\": \"Resources\"\n}\nheaders = {\n \"content-type\": \"application/json\",\n \"authorization\": \"REPLACE_KEY_VALUE\"\n}\n\nresponse = requests.request(\"PUT\", url, json=payload, headers=headers)\n\nprint(response.text)"
- lang: Shell + Curl
source: "curl --request PUT \\\n --url https://api.prismacloud.io/code/api/v1/suppressions/{policyId}/justifications/{suppressionId} \\\n --header 'authorization: REPLACE_KEY_VALUE' \\\n --header 'content-type: application/json' \\\n --data '{\"comment\":\"string\",\"expirationTime\":0,\"origin\":\"string\",\"resources\":[{\"accountId\":\"string\",\"id\":\"string\"}],\"suppressionType\":\"Resources\"}'"
delete:
description: 'Prisma Cloud Application Security supports advanced Suppression rule settings in order to make policy management easier by dismissing or snoozing errors
(using time-bounded suppression rules) that are irrelevant in your cloud and code environments.
Suppression can be applied at various levels: for all cases (Disable Policy), for a specific Source, for a Specific Resource or by tag.
To use the API request, add your token to the header.
Use this API function to delete an existing Prisma Cloud Application Security Suppression rule for a specific given policyId and suppressionId mentioned in the path.
The output will be -
* For successful - 200
* error - 400, failed to delete suppression'
operationId: deleteSuppression
parameters:
- in: path
name: policyId
required: true
schema:
type: string
- in: path
name: suppressionId
required: true
schema:
type: string
responses:
'200':
description: Suppression ID
'422':
description: Request arguments validation error
security:
- CustomAuthorizer: []
summary: Delete Suppression by Suppression ID and Violation ID
tags:
- Suppressions
x-codeSamples:
- lang: Python + Requests
source: 'import requests
url = "https://api.prismacloud.io/code/api/v1/suppressions/{policyId}/justifications/{suppressionId}"
headers = {"authorization": "REPLACE_KEY_VALUE"}
response = requests.request("DELETE", url, headers=headers)
print(response.text)'
- lang: Shell + Curl
source: "curl --request DELETE \\\n --url https://api.prismacloud.io/code/api/v1/suppressions/{policyId}/justifications/{suppressionId} \\\n --header 'authorization: REPLACE_KEY_VALUE'"
/code/api/v1/suppressions/{policyId}/justifications:
get:
description: 'Prisma Cloud Application Security supports advanced Suppression rule settings in order to make policy management easier by dismissing or snoozing errors
(using time-bounded suppression rules) that are irrelevant in your cloud and code environments.
Suppression can be applied at various levels: for all cases (Disable Policy), for a specific Source, for a Specific Resource or by tag.
To use the API request, add your token to the header.
Use this API function to fetch details of Prisma Cloud Application Security Suppressions that have been set for the given policyId and accounts
(array of strings) mentioned in the path.
The output will be -
* success - 200, array of objects { id, policyId, creationDate, comment, suppressionType (Resources, Policy, Tags, Accounts),
resources (array of strings, for suppressionType Resources), accountIds (array of string, for suppressionType Accounts), tags (array of objects { id, accountId } for suppressionType Tags)
* error - 400 failed to get suppression'
operationId: getSuppressionsJustifications
parameters:
- in: path
name: policyId
required: true
schema:
type: string
- in: query
name: accounts
required: true
schema:
items:
type: string
type: array
responses:
'200':
content:
application/json:
examples:
Example 1:
value:
- active: true
comment: No justification comment provided.
customer: acme
date: 1611276779986
id: 7caab873-7400-47f9-8b3f-82b33d0463ed
suppressionType: Policy
type: suppression
violationId: BC_AWS_GENERAL_31
- active: true
comment: Known issue - will be fixed soon
customer: acme
date: 1611276779986
id: 5ed2f9c2-044f-4484-99d1-262b563872ec
resources:
- /terraform/aws/lambda.tf:d70eab08607a4d05faa2d0d6647206599e9abc65
suppressionType: Resources
type: suppression
violationId: BC_AWS_GENERAL_26
- accountIds:
- /terraform/aws/lambda.tf:d70eab08607a4d05faa2d0d6647206599e9abc65
active: true
comment: Known issue - will be fixed soon
customer: acme
date: 1611276779986
id: 5ed2f9c2-044f-4484-99d1-262b563872ec
suppressionType: Accounts
type: suppression
violationId: BC_AWS_GENERAL_14
schema:
items:
$ref: '#/components/schemas/SuppressionsJustifications'
type: array
description: Suppression ID
'422':
description: Request arguments validation error
'500':
description: Failed to get suppression
security:
- CustomAuthorizer: []
summary: Get Suppressions Justifications by Policy ID and Query Accounts
tags:
- Suppressions
x-codeSamples:
- lang: Python + Requests
source: 'import requests
url = "https://api.prismacloud.io/code/api/v1/suppressions/{policyId}/justifications"
querystring = {"accounts":"SOME_ARRAY_VALUE"}
headers = {"authorization": "REPLACE_KEY_VALUE"}
response = requests.request("GET", url, headers=headers, params=querystring)
print(response.text)'
- lang: Shell + Curl
source: "curl --request GET \\\n --url 'https://api.prismacloud.io/code/api/v1/suppressions/{policyId}/justifications?accounts=SOME_ARRAY_VALUE' \\\n --header 'authorization: REPLACE_KEY_VALUE'"
components:
schemas:
CommonSuppressionFields:
additionalProperties: false
properties:
comment:
type: string
creationDate:
type: string
id:
type: string
required:
- id
- comment
type: object
TagsSuppressionCreate:
additionalProperties: false
properties:
comment:
type: string
expirationTime:
format: double
type: number
origin:
type: string
suppressionType:
enum:
- Tags
type: string
tags:
items:
properties:
key:
type: string
value:
type: string
required:
- value
- key
type: object
type: array
required:
- comment
- origin
- suppressionType
- tags
type: object
PolicySuppression:
additionalProperties: false
properties:
suppressionType:
enum:
- Policy
type: string
required:
- suppressionType
type: object
AccountsSuppressionData:
additionalProperties: false
properties:
accountIds:
items:
type: string
type: array
comment:
type: string
creationDate:
type: string
id:
type: string
policyId:
type: string
suppressionType:
enum:
- Accounts
type: string
required:
- id
- policyId
- comment
- suppressionType
- accountIds
type: object
LegacySuppression:
allOf:
- anyOf:
- $ref: '#/components/schemas/AccountsSuppression'
- $ref: '#/components/schemas/PolicySuppression'
- $ref: '#/components/schemas/TagsSuppression'
- $ref: '#/components/schemas/TagsSuppressionData'
- $ref: '#/components/schemas/ResourcesSuppressionLegacy'
- properties:
policyId:
type: string
required:
- policyId
type: object
- $ref: '#/components/schemas/CommonSuppressionFields'
LicenseSuppressionCreate:
additionalProperties: false
properties:
comment:
type: string
expirationTime:
format: double
type: number
licenseTypes:
items:
type: string
type: array
origin:
type: string
suppressionType:
enum:
- LicenseType
type: string
required:
- comment
- origin
- suppressionType
- licenseTypes
type: object
AccountsSuppressionCreate:
additionalProperties: false
properties:
accountIds:
items:
type: string
type: array
comment:
type: string
expirationTime:
format: double
type: number
origin:
type: string
suppressionType:
enum:
- Accounts
type: string
required:
- comment
- origin
- suppressionType
- accountIds
type: object
PolicySuppressionCreate:
additionalProperties: false
properties:
comment:
type: string
expirationTime:
format: double
type: number
origin:
type: string
suppressionType:
enum:
- Policy
type: string
required:
- comment
- origin
- suppressionType
type: object
AccountsSuppression:
additionalProperties: false
properties:
accountIds:
items:
type: string
type: array
suppressionType:
enum:
- Accounts
type: string
required:
- suppressionType
- accountIds
type: object
SuppressionsJustifications:
allOf:
- anyOf:
- $ref: '#/components/schemas/ResourcesSuppressionJustificationData'
- $ref: '#/components/schemas/AccountsSuppressionData'
- $ref: '#/components/schemas/PolicySuppressionData'
- $ref: '#/components/schemas/TagsSuppressionData'
- properties:
type:
type: string
required:
- type
type: object
SuppressionCreate:
anyOf:
- $ref: '#/components/schemas/ResourcesSuppressionCreate'
- $ref: '#/components/schemas/PolicySuppressionCreate'
- $ref: '#/components/schemas/AccountsSuppressionCreate'
- $ref: '#/components/schemas/TagsSuppressionCreate'
- $ref: '#/components/schemas/LicenseSuppressionCreate'
- $ref: '#/components/schemas/PackageSuppressionCreate'
PackageLang:
enum:
- nodejs
- ruby
- python
- jar
- dotNet
- go
- os
type: string
TagsSuppressionData:
additionalProperties: false
properties:
comment:
type: string
creationDate:
type: string
id:
type: string
policyId:
type: string
suppressionType:
enum:
- Tags
type: string
tags:
items:
properties:
key:
type: string
value:
type: string
required:
- value
- key
type: object
type: array
required:
- id
- policyId
- comment
- suppressionType
- tags
type: object
ResourcesSuppressionJustificationData:
additionalProperties: false
properties:
comment:
type: string
creationDate:
type: string
id:
type: string
policyId:
type: string
resources:
items:
type: string
type: array
suppressionType:
enum:
- Resources
type: string
required:
- id
- policyId
- comment
- suppressionType
- resources
type: object
PackageSuppressionCreate:
additionalProperties: false
properties:
comment:
type: string
expirationTime:
format: double
type: number
origin:
type: string
packages:
items:
properties:
language:
$ref: '#/components/schemas/PackageLang'
packageName:
type: string
version:
type: string
required:
- language
- version
- packageName
type: object
type: array
suppressionType:
enum:
- PackageLicense
type: string
required:
- comment
- origin
- suppressionType
- packages
type: object
PolicySuppressionData:
additionalProperties: false
properties:
comment:
type: string
creationDate:
type: string
id:
type: string
policyId:
type: string
suppressionType:
enum:
- Policy
type: string
required:
- id
- policyId
- comment
- suppressionType
type: object
ResourcesSuppressionLegacy:
additionalProperties: false
properties:
resources:
items:
properties:
accountId:
type: string
resourceId:
type: string
required:
- resourceId
- accountId
type: object
type: array
suppressionType:
enum:
- Resources
type: string
required:
- suppressionType
- resources
type: object
ResourcesSuppressionCreate:
additionalProperties: false
properties:
comment:
type: string
expirationTime:
format: double
type: number
origin:
type: string
resources:
items:
properties:
accountId:
type: string
id:
type: string
required:
- id
- accountId
type: object
type: array
suppressionType:
enum:
- Resources
type: string
required:
- comment
- origin
- suppressionType
- resources
type: object
TagsSuppression:
additionalProperties: false
properties:
suppressionType:
enum:
- Tags
type: string
tags:
items:
properties:
key:
type: string
value:
type: string
required:
- value
- key
type: object
type: array
required:
- suppressionType
- tags
type: object
securitySchemes:
CustomAuthorizer:
in: header
name: authorization
type: apiKey
x-amazon-apigateway-authorizer:
authorizerResultTtlInSeconds: 0
authorizerUri: arn:aws:apigateway:{Region}:lambda:path/2015-03-31/functions/arn:aws:lambda:{Region}:{AccountId}:function:bc-authorization-authorizer-{UniqueTag}{Alias}/invocations
identitySource: method.request.header.authorization
type: request
x-amazon-apigateway-authtype: custom