Palo Alto Networks User Profile API

openapi: 3.2.0
info:
  contact: {}
  description: 'Access Keys are a secure way to enable programmatic access to the Prisma Cloud API. By default, only

    the System Admin has API access and can enable API access for other administrators. If you have API access,

    you can create up to two access keys. Create an access key for a limited time period and regenerate your API

    keys periodically to minimize exposure and follow security best practices.'
  title: Prisma Cloud Access Keys API Overview User Profile API
  version: Latest
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
tags:
- description: Manage your Prisma Cloud user profiles.
  name: User Profile
paths:
  /user/me:
    get:
      description: Returns the current user's personal profile information.
      operationId: get-my-profile
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MultiRoleUserProfile1'
          description: successful operation
        '400':
          description: user_inactive_or_not_exist
        '500':
          description: failed_fetch_user_profile
      security:
      - x-redlock-auth: []
      summary: Profile
      tags:
      - User Profile
    put:
      description: 'Updates the current user''s personal profile information.


        This request supports four optional request body parameters, which you can see in the JSON example below:

        ```

        {

        "defaultRoleId": "",

        "firstName": "",

        "lastName": "",

        "timeZone": "",

        }

        ```


        The red **required** labels in the request body schema below apply only when you create a new user profile, so the labels don''t apply to this request.'
      operationId: update-my-profile
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultiRoleUserProfile1'
        description: Model containing user profile
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: empty_user_profile_provided / missing_first_name / missing_time_zone / invalid_time_zone / user_inactive_or_not_exist / default_role_not_belonging_to_user_role_list / invalid_user_role
        '403':
          description: cannot_disable_own_profile / access_keys_cannot_update_owner_profile
        '500':
          description: failed_update_user_profile
      security:
      - x-redlock-auth: []
      summary: Update Profile
      tags:
      - User Profile
  /v3/user:
    get:
      description: Lists all users and service accounts for your tenant.
      operationId: get-user-profiles-v3
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/UserAccountModel'
                type: array
          description: successful operation
        '500':
          description: failed_fetch_user_profile
      security:
      - x-redlock-auth: []
      summary: List Users V3
      tags:
      - User Profile
    post:
      description: 'Adds either a user profile or a service account profile.


        The required request body parameters differ, depending on whether you are adding a user account or a service account. Specify whether

        you''re adding a user account or service account through the request parameter **type**.


        The required parameters to add a user account are:


        * **email**

        * **firstName**

        * **lastName**

        * **roleIds**

        * **defaultRoleId**

        * **timeZone**


        The required parameters to add a service account are:


        * **username**

        * **accessKeyName**

        * **accessKeyExpiration** (Required only if **enableKeyExpiration** is **true**)

        * **defaultRoleId**

        * **timeZone**'
      operationId: add-user-v3
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserAccountModel'
        description: Model for User Account
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateUserAccessKeyResponseModel'
          description: successful operation
        '400':
          description: empty_user_profile_provided / missing_email / wrong_email_format / missing_first_name / missing_time_zoneinvalid_time_zone /  missing_required_parameter / no_role_assigned_to_user / exceeding_role_limit_number / default_role_not_belonging_to_user_role_list / invalid_user_role
        '409':
          description: duplicate_user_name
        '500':
          description: failed_add_user_profile
      security:
      - x-redlock-auth: []
      summary: Add User Profile V3
      tags:
      - User Profile
  /v2/user:
    get:
      description: Returns a list of all the users belonging to the same tenant. Response includes multiple roles assigned to each user.
      operationId: get-user-profiles-v2
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/UserProfileModel'
                type: array
          description: successful operation
        '500':
          description: failed_fetch_user_profile
      security:
      - x-redlock-auth: []
      summary: List Users V2
      tags:
      - User Profile
    post:
      description: Adds a new administrative user. Supports multiple roles for a single user.
      operationId: add-user-v2
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultiRoleUserProfile1'
        description: Model containing user profile
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: empty_user_profile_provided / missing_email / wrong_email_format / missing_first_name / missing_time_zoneinvalid_time_zone /  missing_required_parameter / no_role_assigned_to_user / exceeding_role_limit_number / default_role_not_belonging_to_user_role_list / invalid_user_role
        '409':
          description: duplicate_user_name
        '500':
          description: failed_add_user_profile
      security:
      - x-redlock-auth: []
      summary: Add User Profile V2
      tags:
      - User Profile
  /v2/user/{id}:
    get:
      description: Returns the user profile for the specified email ID. Supports multiple roles for a single user.
      operationId: get-user-profile-v2
      parameters:
      - description: User email
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserProfileModel'
          description: successful operation
        '400':
          description: user_inactive_or_not_exist
        '500':
          description: failed_fetch_user_profile
      security:
      - x-redlock-auth: []
      summary: Get User Profile V2
      tags:
      - User Profile
    put:
      description: 'Updates an administrative user''s profile. Supports multiple roles for a single user.


        The current **email** of the user whose profile you want to update is a required request parameter. All other request parameters are optional. The red **required** labels in the request body schema below apply only when you create a new user profile.'
      operationId: update-profile-v2
      parameters:
      - description: User email
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultiRoleUserProfile1'
      responses:
        '200':
          description: successful operation
        '400':
          description: empty_user_profile_provided / missing_first_name / missing_time_zone / invalid_time_zone / user_inactive_or_not_exist / exceeding_role_limit_number / default_role_not_belonging_to_user_role_list / invalid_user_role / invalid_user_role
        '403':
          description: cannot_remove_current_log_in_role
        '500':
          description: failed_update_user_profile
      security:
      - x-redlock-auth: []
      summary: Update User Profile V2
      tags:
      - User Profile
  /user/{id}:
    delete:
      description: Deletes a user or service account profile.
      operationId: delete-user
      parameters:
      - description: User email or service account name
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      responses:
        '200':
          description: successful operation
        '400':
          description: user_inactive_or_not_exist
        '403':
          description: cannot_delete_own_profile
        '500':
          description: internal_error
      security:
      - x-redlock-auth: []
      summary: Delete User Profile
      tags:
      - User Profile
  /user/{id}/status/{enabled}:
    patch:
      description: Enables or disables a user profile.
      operationId: update-user-profile
      parameters:
      - description: User email
        in: path
        name: id
        required: true
        schema:
          pattern: .+
          type: string
      - description: Status to set
        in: path
        name: enabled
        required: true
        schema:
          type: boolean
      responses:
        '200':
          description: successful operation
      security:
      - x-redlock-auth: []
      summary: Update User Status
      tags:
      - User Profile
  /user/name:
    get:
      description: Returns a list of emails for all non-deleted users in the system.
      operationId: get-usernames
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  additionalProperties:
                    type: string
                  type: object
                type: array
          description: successful operation
        '500':
          description: failed_fetch_users_emails
      security:
      - x-redlock-auth: []
      summary: List User Emails
      tags:
      - User Profile
  /user/domain:
    get:
      description: Returns a list of domains in allow list.
      operationId: email-domains
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  type: string
                type: array
          description: successful operation
        '400':
          description: no_user_added
        '500':
          description: failed_fetch_email_domain_allow_list
      security:
      - x-redlock-auth: []
      summary: List Email Domains
      tags:
      - User Profile
  /user/saml/bypass:
    get:
      description: 'Returns a list of users who can log in via both SAML provider and username/password flows.


        The request body is an array of emails to be bypassed.

        ```

        [ "jon.snow@example.com", "daenerys@example.com" ]

        ```'
      operationId: get-sso-bypass-allowed-users
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  type: string
                type: array
                uniqueItems: true
          description: successful operation
        '500':
          description: failed_fetch_sso_bypass_allowed_users
      security:
      - x-redlock-auth: []
      summary: List SSO Bypass Allowed Users
      tags:
      - User Profile
    put:
      description: Given a list of Prisma Cloud user emails, enables each user in the list to log into Prisma Cloud through either a SAML provider or direct user name and password entry.
      operationId: update-sso-bypass-allowed-users
      requestBody:
        content:
          application/json:
            schema:
              items:
                type: string
              type: array
        description: SSO Bypass allowed users
        required: true
      responses:
        '200':
          description: successful operation
        '400':
          description: missing_sso_bypass_allowed_users
        '500':
          description: failed_update_sso_bypass_allowed_users
      security:
      - x-redlock-auth: []
      summary: Update SSO Bypass Allowed Users
      tags:
      - User Profile
components:
  schemas:
    CreateUserAccessKeyResponseModel:
      description: Model for create user access key response
      properties:
        id:
          description: Access key ID
          type: string
        secretKey:
          description: Access key secret
          type: string
      type: object
    MultiRoleUserProfile1:
      description: Model containing user profile
      properties:
        accessKeysAllowed:
          description: Access keys allowed
          type: boolean
        activeRole:
          allOf:
          - $ref: '#/components/schemas/UserProfileRoleDetailModel'
          - description: Active Role Info
            readOnly: true
        defaultRoleId:
          description: Default Role ID
          type: string
        displayName:
          description: Display name
          readOnly: true
          type: string
        email:
          description: Email ID
          type: string
        enabled:
          description: Enabled
          readOnly: true
          type: boolean
        firstName:
          description: First name. Maximum length is 300 characters.
          type: string
        lastLoginTs:
          description: Last login time
          format: int64
          readOnly: true
          type: integer
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time profile was last updated
          format: int64
          readOnly: true
          type: integer
        lastName:
          description: Last name.  Maximum length is 300 characters.
          type: string
        roleIds:
          description: Role IDs
          items:
            type: string
          type: array
        roles:
          description: All Role Info
          items:
            $ref: '#/components/schemas/UserProfileRoleDetailModel'
          readOnly: true
          type: array
        timeZone:
          description: Time zone (e.g. America/Los_Angeles)
          type: string
      required:
      - defaultRoleId
      - email
      - firstName
      - lastName
      - roleIds
      - timeZone
      type: object
    UserProfileRoleDetailModel:
      description: Model for User Profile Role Detail
      properties:
        id:
          description: User Role ID
          readOnly: true
          type: string
        name:
          description: User Role Name
          readOnly: true
          type: string
        onlyAllowCIAccess:
          description: true = Allow only CI Access for Build and Deploy security roles
          readOnly: true
          type: boolean
        onlyAllowComputeAccess:
          description: true = Allow only Compute Access for reduced system admin roles
          readOnly: true
          type: boolean
        onlyAllowReadAccess:
          description: true = Allow only Read Access for
          readOnly: true
          type: boolean
        type:
          description: User Role Type (Default or Custom Permission Group Name).
          readOnly: true
          type: string
      type: object
    UserAccountModel:
      description: Model for User Account
      properties:
        accessKeyExpiration:
          description: Access key expiration timestamp in milliseconds
          format: int64
          type: integer
        accessKeyName:
          description: Access key name
          type: string
        accessKeysAllowed:
          description: Access keys allowed
          type: boolean
        accessKeysCount:
          description: Access key count
          format: int32
          readOnly: true
          type: integer
        activeRole:
          allOf:
          - $ref: '#/components/schemas/UserProfileRoleDetailModel'
          - description: Active Role Info
            readOnly: true
        defaultRoleId:
          description: Default Role ID
          type: string
        displayName:
          description: Display name
          readOnly: true
          type: string
        email:
          description: Email ID
          type: string
        enableKeyExpiration:
          description: true = Enable access key expiration. Default is false.
          type: boolean
        enabled:
          description: Enabled
          readOnly: true
          type: boolean
        firstName:
          description: First name. Maximum length is 300 characters.
          type: string
        lastLoginTs:
          description: Last login time
          format: int64
          readOnly: true
          type: integer
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time profile was last updated
          format: int64
          readOnly: true
          type: integer
        lastName:
          description: Last name.  Maximum length is 300 characters.
          type: string
        roleIds:
          description: Role IDs
          items:
            type: string
          type: array
        roles:
          description: All Role Info
          items:
            $ref: '#/components/schemas/UserProfileRoleDetailModel'
          readOnly: true
          type: array
        timeZone:
          description: Time zone (e.g. America/Los_Angeles)
          type: string
        type:
          description: User type. Default is USER_ACCOUNT.
          enum:
          - USER_ACCOUNT
          - SERVICE_ACCOUNT
          type: string
        username:
          description: User or service account name. Maximum length is 300 characters.
          type: string
      type: object
    UserProfileModel:
      description: Model containing user profile
      properties:
        accessKeysAllowed:
          description: Access keys allowed
          type: boolean
        displayName:
          description: Display name
          readOnly: true
          type: string
        email:
          description: Email ID
          type: string
        enabled:
          description: Enabled
          readOnly: true
          type: boolean
        firstName:
          description: First name. Maximum length is 300 characters.
          type: string
        lastLoginTs:
          description: Last login time
          format: int64
          readOnly: true
          type: integer
        lastModifiedBy:
          description: Last modified by
          readOnly: true
          type: string
        lastModifiedTs:
          description: Time profile was last updated
          format: int64
          readOnly: true
          type: integer
        lastName:
          description: Last name.  Maximum length is 300 characters.
          type: string
        role:
          additionalProperties:
            type: string
          description: Role
          readOnly: true
          type: object
        roleId:
          description: Role ID
          type: string
        roleType:
          description: Role type
          readOnly: true
          type: string
        timeZone:
          description: Time zone (e.g. America/Los_Angeles)
          type: string
      required:
      - email
      - firstName
      - lastName
      - roleId
      - timeZone
      type: object
  securitySchemes:
    x-redlock-auth:
      description: The x-redlock-auth value is a JSON Web Token (JWT).
      in: header
      name: x-redlock-auth
      type: apiKey