Palo Alto Networks User Profile API
Manage your Prisma Cloud user profiles.
OpenAPI Specification
openapi: 3.2.0
info:
title: Palo Alto Networks User Profile API
version: Latest
contact: {}
description: 'Operations tagged User Profile across 2 of this provider''s published API definitions: palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json, palo-alto-cspm-userprofile-openapi.json. Each path carries the servers of the definition it was published in.'
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
- url: https://api.anz.prismacloud.io
- url: https://api.eu.prismacloud.io
- url: https://api2.eu.prismacloud.io
- url: https://api.gov.prismacloud.io
- url: https://api.prismacloud.cn
- url: https://api.ca.prismacloud.io
- url: https://api.sg.prismacloud.io
- url: https://api.uk.prismacloud.io
- url: https://api.ind.prismacloud.io
- url: https://api.jp.prismacloud.io
- url: https://api.fr.prismacloud.io
tags:
- description: 'Manage your Prisma Cloud user profiles.
'
name: User Profile
paths:
/user/me:
get:
description: Returns the current user's personal profile information.
operationId: get-my-profile
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/MultiRoleUserProfile1'
description: successful operation
'400':
description: user_inactive_or_not_exist
'500':
description: failed_fetch_user_profile
security:
- x-redlock-auth: []
summary: Profile
tags:
- User Profile
put:
description: "Updates the current user's personal profile information. \n\nThis request supports four optional request body parameters, which you can see in the JSON example below:\n```\n{\n \"defaultRoleId\": \"\",\n \"firstName\": \"\",\n \"lastName\": \"\",\n \"timeZone\": \"\", \n}\n```\n\nThe red **required** labels in the request body schema below apply only when you create a new user profile, so the labels don't apply to this request.\n"
operationId: update-my-profile
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MultiRoleUserProfile1'
description: Model containing user profile
required: true
responses:
'200':
description: successful operation
'400':
description: empty_user_profile_provided / missing_first_name / missing_time_zone / invalid_time_zone / user_inactive_or_not_exist / default_role_not_belonging_to_user_role_list / invalid_user_role
'403':
description: cannot_disable_own_profile / access_keys_cannot_update_owner_profile
'500':
description: failed_update_user_profile
security:
- x-redlock-auth: []
summary: Update Profile
tags:
- User Profile
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/v3/user:
get:
description: Lists all users and service accounts for your tenant.
operationId: get-user-profiles-v3
responses:
'200':
content:
application/json:
schema:
items:
$ref: '#/components/schemas/UserAccountModel'
type: array
description: successful operation
'500':
description: failed_fetch_user_profile
security:
- x-redlock-auth: []
summary: List Users V3
tags:
- User Profile
post:
description: "Adds either a user profile or a service account profile. \n\nThe required request body parameters differ, depending on whether you are adding a user account or a service account. Specify whether \nyou're adding a user account or service account through the request parameter **type**.\n\nThe required parameters to add a user account are:\n\n* **email**\n* **firstName**\n* **lastName**\n* **roleIds**\n* **defaultRoleId**\n* **timeZone**\n\nThe required parameters to add a service account are:\n\n* **username**\n* **accessKeyName**\n* **accessKeyExpiration** (Required only if **enableKeyExpiration** is **true**)\n* **defaultRoleId**\n* **timeZone**\n"
operationId: add-user-v3
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UserAccountModel'
description: Model for User Account
required: true
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/CreateUserAccessKeyResponseModel'
description: successful operation
'400':
description: empty_user_profile_provided / missing_email / wrong_email_format / missing_first_name / missing_time_zoneinvalid_time_zone / missing_required_parameter / no_role_assigned_to_user / exceeding_role_limit_number / default_role_not_belonging_to_user_role_list / invalid_user_role
'409':
description: duplicate_user_name
'500':
description: failed_add_user_profile
security:
- x-redlock-auth: []
summary: Add User Profile V3
tags:
- User Profile
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/v2/user:
get:
description: Returns a list of all the users belonging to the same tenant. Response includes multiple roles assigned to each user.
operationId: get-user-profiles-v2
responses:
'200':
content:
application/json:
schema:
items:
$ref: '#/components/schemas/UserProfileModel'
type: array
description: successful operation
'500':
description: failed_fetch_user_profile
security:
- x-redlock-auth: []
summary: List Users V2
tags:
- User Profile
post:
description: Adds a new administrative user. Supports multiple roles for a single user.
operationId: add-user-v2
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MultiRoleUserProfile1'
description: Model containing user profile
required: true
responses:
'200':
description: successful operation
'400':
description: empty_user_profile_provided / missing_email / wrong_email_format / missing_first_name / missing_time_zoneinvalid_time_zone / missing_required_parameter / no_role_assigned_to_user / exceeding_role_limit_number / default_role_not_belonging_to_user_role_list / invalid_user_role
'409':
description: duplicate_user_name
'500':
description: failed_add_user_profile
security:
- x-redlock-auth: []
summary: Add User Profile V2
tags:
- User Profile
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/v2/user/{id}:
get:
description: Returns the user profile for the specified email ID. Supports multiple roles for a single user.
operationId: get-user-profile-v2
parameters:
- description: User email
in: path
name: id
required: true
schema:
pattern: .+
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/UserProfileModel'
description: successful operation
'400':
description: user_inactive_or_not_exist
'500':
description: failed_fetch_user_profile
security:
- x-redlock-auth: []
summary: Get User Profile V2
tags:
- User Profile
put:
description: "Updates an administrative user's profile. Supports multiple roles for a single user. \n\nThe current **email** of the user whose profile you want to update is a required request parameter. All other request parameters are optional. The red **required** labels in the request body schema below apply only when you create a new user profile.\n"
operationId: update-profile-v2
parameters:
- description: User email
in: path
name: id
required: true
schema:
pattern: .+
type: string
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/MultiRoleUserProfile1'
responses:
'200':
description: successful operation
'400':
description: empty_user_profile_provided / missing_first_name / missing_time_zone / invalid_time_zone / user_inactive_or_not_exist / exceeding_role_limit_number / default_role_not_belonging_to_user_role_list / invalid_user_role / invalid_user_role
'403':
description: cannot_remove_current_log_in_role
'500':
description: failed_update_user_profile
security:
- x-redlock-auth: []
summary: Update User Profile V2
tags:
- User Profile
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/user/{id}:
delete:
description: Deletes a user or service account profile.
operationId: delete-user
parameters:
- description: User email or service account name
in: path
name: id
required: true
schema:
pattern: .+
type: string
responses:
'200':
description: successful operation
'400':
description: user_inactive_or_not_exist
'403':
description: cannot_delete_own_profile
'500':
description: internal_error
security:
- x-redlock-auth: []
summary: Delete User Profile
tags:
- User Profile
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/user/{id}/status/{enabled}:
patch:
description: Enables or disables a user profile.
operationId: update-user-profile
parameters:
- description: User email
in: path
name: id
required: true
schema:
pattern: .+
type: string
- description: Status to set
in: path
name: enabled
required: true
schema:
type: boolean
responses:
'200':
description: successful operation
security:
- x-redlock-auth: []
summary: Update User Status
tags:
- User Profile
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/user/name:
get:
description: Returns a list of emails for all non-deleted users in the system.
operationId: get-usernames
responses:
'200':
content:
application/json:
schema:
items:
additionalProperties:
type: string
type: object
type: array
description: successful operation
'500':
description: failed_fetch_users_emails
security:
- x-redlock-auth: []
summary: List User Emails
tags:
- User Profile
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/user/domain:
get:
description: Returns a list of domains in allow list.
operationId: email-domains
responses:
'200':
content:
application/json:
schema:
items:
type: string
type: array
description: successful operation
'400':
description: no_user_added
'500':
description: failed_fetch_email_domain_allow_list
security:
- x-redlock-auth: []
summary: List Email Domains
tags:
- User Profile
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
/user/saml/bypass:
get:
description: "Returns a list of users who can log in via both SAML provider and username/password flows. \n\nThe request body is an array of emails to be bypassed.\n```\n [ \"jon.snow@example.com\", \"daenerys@example.com\" ]\n```\n"
operationId: get-sso-bypass-allowed-users
responses:
'200':
content:
application/json:
schema:
items:
type: string
type: array
uniqueItems: true
description: successful operation
'500':
description: failed_fetch_sso_bypass_allowed_users
security:
- x-redlock-auth: []
summary: List SSO Bypass Allowed Users
tags:
- User Profile
put:
description: Given a list of Prisma Cloud user emails, enables each user in the list to log into Prisma Cloud through either a SAML provider or direct user name and password entry.
operationId: update-sso-bypass-allowed-users
requestBody:
content:
application/json:
schema:
items:
type: string
type: array
description: SSO Bypass allowed users
required: true
responses:
'200':
description: successful operation
'400':
description: missing_sso_bypass_allowed_users
'500':
description: failed_update_sso_bypass_allowed_users
security:
- x-redlock-auth: []
summary: Update SSO Bypass Allowed Users
tags:
- User Profile
servers:
- url: https://api.prismacloud.io
- url: https://api2.prismacloud.io
- url: https://api3.prismacloud.io
- url: https://api4.prismacloud.io
components:
schemas:
UserProfileModel:
description: Model containing user profile
properties:
accessKeysAllowed:
description: Access keys allowed
type: boolean
displayName:
description: Display name
readOnly: true
type: string
email:
description: Email ID
type: string
enabled:
description: Enabled
readOnly: true
type: boolean
firstName:
description: First name. Maximum length is 300 characters.
type: string
lastLoginTs:
description: Last login time
format: int64
readOnly: true
type: integer
lastModifiedBy:
description: Last modified by
readOnly: true
type: string
lastModifiedTs:
description: Time profile was last updated
format: int64
readOnly: true
type: integer
lastName:
description: Last name. Maximum length is 300 characters.
type: string
role:
additionalProperties:
type: string
description: Role
readOnly: true
type: object
roleId:
description: Role ID
type: string
roleType:
description: Role type
readOnly: true
type: string
timeZone:
description: Time zone (e.g. America/Los_Angeles)
type: string
required:
- email
- firstName
- lastName
- roleId
- timeZone
type: object
UserAccountModel:
description: Model for User Account
properties:
accessKeyExpiration:
description: Access key expiration timestamp in milliseconds
format: int64
type: integer
accessKeyName:
description: Access key name
type: string
accessKeysAllowed:
description: Access keys allowed
type: boolean
accessKeysCount:
description: Access key count
format: int32
readOnly: true
type: integer
activeRole:
allOf:
- $ref: '#/components/schemas/UserProfileRoleDetailModel'
- description: Active Role Info
readOnly: true
defaultRoleId:
description: Default Role ID
type: string
displayName:
description: Display name
readOnly: true
type: string
email:
description: Email ID
type: string
enableKeyExpiration:
description: true = Enable access key expiration. Default is false.
type: boolean
enabled:
description: Enabled
readOnly: true
type: boolean
firstName:
description: First name. Maximum length is 300 characters.
type: string
lastLoginTs:
description: Last login time
format: int64
readOnly: true
type: integer
lastModifiedBy:
description: Last modified by
readOnly: true
type: string
lastModifiedTs:
description: Time profile was last updated
format: int64
readOnly: true
type: integer
lastName:
description: Last name. Maximum length is 300 characters.
type: string
roleIds:
description: Role IDs
items:
type: string
type: array
roles:
description: All Role Info
items:
$ref: '#/components/schemas/UserProfileRoleDetailModel'
readOnly: true
type: array
timeZone:
description: Time zone (e.g. America/Los_Angeles)
type: string
type:
description: User type. Default is USER_ACCOUNT.
enum:
- USER_ACCOUNT
- SERVICE_ACCOUNT
type: string
username:
description: User or service account name. Maximum length is 300 characters.
type: string
type: object
CreateUserAccessKeyResponseModel:
description: Model for create user access key response
properties:
id:
description: Access key ID
type: string
secretKey:
description: Access key secret
type: string
type: object
UserProfileRoleDetailModel:
description: Model for User Profile Role Detail
properties:
id:
description: User Role ID
readOnly: true
type: string
name:
description: User Role Name
readOnly: true
type: string
onlyAllowCIAccess:
description: true = Allow only CI Access for Build and Deploy security roles
readOnly: true
type: boolean
onlyAllowComputeAccess:
description: true = Allow only Compute Access for reduced system admin roles
readOnly: true
type: boolean
onlyAllowReadAccess:
description: true = Allow only Read Access for
readOnly: true
type: boolean
type:
description: User Role Type (Default or Custom Permission Group Name).
readOnly: true
type: string
type: object
MultiRoleUserProfile1:
description: Model containing user profile
properties:
accessKeysAllowed:
description: Access keys allowed
type: boolean
activeRole:
allOf:
- $ref: '#/components/schemas/UserProfileRoleDetailModel'
- description: Active Role Info
readOnly: true
defaultRoleId:
description: Default Role ID
type: string
displayName:
description: Display name
readOnly: true
type: string
email:
description: Email ID
type: string
enabled:
description: Enabled
readOnly: true
type: boolean
firstName:
description: First name. Maximum length is 300 characters.
type: string
lastLoginTs:
description: Last login time
format: int64
readOnly: true
type: integer
lastModifiedBy:
description: Last modified by
readOnly: true
type: string
lastModifiedTs:
description: Time profile was last updated
format: int64
readOnly: true
type: integer
lastName:
description: Last name. Maximum length is 300 characters.
type: string
roleIds:
description: Role IDs
items:
type: string
type: array
roles:
description: All Role Info
items:
$ref: '#/components/schemas/UserProfileRoleDetailModel'
readOnly: true
type: array
timeZone:
description: Time zone (e.g. America/Los_Angeles)
type: string
required:
- defaultRoleId
- email
- firstName
- lastName
- roleIds
- timeZone
type: object
MultiRoleUserProfile:
description: Model containing user profile
properties:
accessKeysAllowed:
description: Access keys allowed
type: boolean
activeRole:
allOf:
- $ref: '#/components/schemas/UserProfileRoleDetailModel'
- description: Active Role Info
readOnly: true
defaultRoleId:
description: Default Role ID
type: string
displayName:
description: Display name
readOnly: true
type: string
email:
description: Email ID
type: string
enabled:
description: Enabled
readOnly: true
type: boolean
firstName:
description: First name. Maximum length is 300 characters.
type: string
lastLoginTs:
description: Last login time
format: int64
readOnly: true
type: integer
lastModifiedBy:
description: Last modified by
readOnly: true
type: string
lastModifiedTs:
description: Time profile was last updated
format: int64
readOnly: true
type: integer
lastName:
description: Last name. Maximum length is 300 characters.
type: string
roleIds:
description: Role IDs
items:
type: string
type: array
roles:
description: All Role Info
items:
$ref: '#/components/schemas/UserProfileRoleDetailModel'
readOnly: true
type: array
timeZone:
description: Time zone (e.g. America/Los_Angeles)
type: string
required:
- defaultRoleId
- email
- firstName
- lastName
- roleIds
- timeZone
type: object
securitySchemes:
x-redlock-auth:
description: The x-redlock-auth value is a JSON Web Token (JWT).
in: header
name: x-redlock-auth
type: apiKey
x-refined-from:
- palo-alto-cspm-consolidated-spec-cspm-spec-openapi.json
- palo-alto-cspm-userprofile-openapi.json