{ "openapi": "3.0.1", "x-hideTryItPanel": true, "info": { "title": "Cloud Infrastructure Entitlement Management APIs", "description": "Use the Cloud Infrastructure Entitlement Management (CIEM) APIs to retrieve and manage access information across cloud environments. These APIs provide access to CIEM resources and insights to support least privilege access.\n\nThe available endpoints include:\n\n* **Search CIEM Access**: Retrieves a list of access entries based on specified filters, sorting, and pagination.\n* **Least Privilege Access Suggestion for an Asset**: Returns least privilege access (LPA) recommendations based on an asset's existing IAM policies or roles.", "version": "Cortex Cloud 2.2", "contact": { "email": "docs-cortex@paloaltonetworks.com", "name": "Cortex Documentation Team", "url": "https://cortex-docs.paloaltonetworks.com/" } }, "servers": [ { "url": "https://api-yourfqdn", "description": "" } ], "security": [], "paths": { "/public_api/ciem/v1/assets/{assetId}/least-privileged-access": { "parameters": [ { "schema": { "type": "string" }, "name": "assetId", "description": "Unique identifier of the asset.", "in": "path", "required": true } ], "get": { "operationId": "custom-least-privilege-access-by-uai", "summary": "Least Privilege Access suggestion for an asset", "description": "Returns least privilege access (LPA) recommendations based on the asset's existing IAM policies or roles. The recommendations preserve all actions performed by the asset during the specified lookback period while minimizing the number of existing policies or roles required. \n\nUse this endpoint to apply the returned configuration snippets to remediate over-privileged identities.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security.", "tags": [ "CIEM" ], "parameters": [ { "name": "assetId", "in": "path", "description": "Unique identifier of the asset.", "required": true, "schema": { "type": "string", "example": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2" } }, { "name": "output_format", "in": "query", "description": "Format of the remediation configuration snippets returned in `recommendationSnippets`. Supported values depend on the selected `cloud_type`:\n- `JSON` — Supported for AWS, Azure, and GCP\n- `TERRAFORM` — Supported for AWS, Azure, and GCP\n- `CF` — Supported only for AWS (CloudFormation)\n- `CLI` — Supported only for GCP\n- `ALL` — Returns all supported formats available for the asset's cloud provider (AWS, Azure, or GCP)", "required": true, "schema": { "type": "string", "enum": [ "JSON", "TERRAFORM", "CF", "CLI", "ALL" ], "example": "JSON" } }, { "name": "lookback_duration_days", "in": "query", "description": "Number of days to look back when evaluating actions performed by the asset. Only actions observed during this lookback period are used to generate the least-privilege configuration.", "schema": { "type": "integer", "example": 90, "minimum": 1, "maximum": 365 }, "required": true }, { "name": "cloud_type", "in": "query", "description": "Cloud service provider associated with the asset. This value must match the asset's actual cloud provider. The supported `output_format` values depend on the selected cloud provider.", "required": true, "schema": { "type": "string", "enum": [ "AWS", "AZURE", "GCP" ], "example": "AWS" } }, { "name": "Authorization", "in": "header", "description": "{api_key}", "required": true, "schema": { "type": "string", "example": "your_api_key" } }, { "name": "x-xdr-auth-id", "in": "header", "description": "{api_key_id}", "required": true, "schema": { "type": "string", "example": "1" } } ], "responses": { "200": { "description": "OK. Indicates that the Least Privilege Access suggestion generated successfully.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CustomLeastPrivilegedAccessResponseDto" }, "examples": { "output_format=JSON (AWS asset)": { "summary": "JSON format — AWS asset with over-privileged permissions", "description": "Response when `output_format=JSON`.", "value": { "recommendationSnippets": { "json": [ "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Resource\":[\"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/example-lambda-function:*\"],\"Action\":[\"logs:PutLogEvents\"],\"Condition\":{},\"Effect\":\"Allow\"}]}" ] }, "verdicts": [ { "actionName": "logs:CreateLogGroup", "policyName": "AWSLambdaBasicExecutionRole", "recommendation": "Remove", "source": "CIEM_LAST_ACCESS" }, { "actionName": "logs:PutLogEvents", "policyName": "AWSLambdaBasicExecutionRole", "recommendation": "Keep", "source": "CIEM_LAST_ACCESS" } ], "recommendedActionType": "applySnippets" } }, "output_format=TERRAFORM (AWS asset)": { "summary": "TERRAFORM format — AWS asset with over-privileged permissions", "description": "Response when `output_format=TERRAFORM`. ", "value": { "recommendationSnippets": { "terraform": [ "resource \"aws_iam_policy\" \"least-privileged-policy\" {\n name = \"prisma_arn:aws:iam::123456789012:role/service-role/example-lambda-role-a1b2c3d4_least_privileged_policy_2025-06-15T09:30:00.000000000\"\n path = \"/\"\n description = \"My least privileged policy\"\n\n # Terraform's \"jsonencode\" function converts a\n # Terraform expression result to valid JSON syntax.\n policy = jsonencode({\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Resource\": [\n \"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/example-lambda-function:*\"\n ],\n \"Action\": [\n \"logs:PutLogEvents\"\n ],\n \"Condition\": {},\n \"Effect\": \"Allow\"\n }\n ]\n })\n}" ] }, "verdicts": [ { "actionName": "logs:CreateLogGroup", "policyName": "AWSLambdaBasicExecutionRole", "recommendation": "Remove", "source": "CIEM_LAST_ACCESS" }, { "actionName": "logs:PutLogEvents", "policyName": "AWSLambdaBasicExecutionRole", "recommendation": "Keep", "source": "CIEM_LAST_ACCESS" } ], "recommendedActionType": "applySnippets" } }, "output_format=CF (AWS asset)": { "summary": "CF format — AWS asset with over-privileged permissions", "description": "Response when `output_format=CF`. CF format is supported for AWS assets only.", "value": { "recommendationSnippets": { "cloudFormation": [ "{\"Type\":\"AWS::IAM::Policy\",\"Properties\":{\"PolicyDocument\":{\"Version\":\"2012-10-17\",\"Statement\":[{\"Resource\":[\"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/example-lambda-function:*\"],\"Action\":[\"logs:PutLogEvents\"],\"Condition\":{},\"Effect\":\"Allow\"}]},\"PolicyName\":\"prisma_arn:aws:iam::123456789012:role/service-role/example-lambda-role-a1b2c3d4_least_privileged_policy_2025-06-15T09:30:00.000000000\"}}" ] }, "verdicts": [ { "actionName": "logs:CreateLogGroup", "policyName": "AWSLambdaBasicExecutionRole", "recommendation": "Remove", "source": "CIEM_LAST_ACCESS" }, { "actionName": "logs:PutLogEvents", "policyName": "AWSLambdaBasicExecutionRole", "recommendation": "Keep", "source": "CIEM_LAST_ACCESS" } ], "recommendedActionType": "applySnippets" } }, "output_format=CLI (GCP asset)": { "summary": "CLI format — GCP asset with over-privileged permissions", "description": "Response when `output_format=CLI`. CLI format is supported for GCP assets only.", "value": { "recommendationSnippets": { "cli": [ "gcloud projects add-iam-policy-binding {projectId} --member=\"serviceAccount:{serviceAccountEmail}\" --role=\"projects/{projectId}/roles/prisma_{principalId}_least_privileged_role_{timestamp}\"" ] }, "verdicts": [ { "actionName": "compute.instances.get", "policyName": "roles/compute.viewer", "recommendation": "Keep", "source": "CIEM_LAST_ACCESS" }, { "actionName": "compute.instances.delete", "policyName": "roles/compute.admin", "recommendation": "Remove", "source": "CIEM_LAST_ACCESS" } ], "recommendedActionType": "applySnippets" } } } } } }, "400": { "description": "Bad Request — The request is malformed or contains invalid parameter values." }, "401": { "description": "Unauthorized — The `Authorization` header is missing or contains an invalid API key." }, "500": { "description": "Internal Server Error — The server encountered an unexpected error. This may occur if the specified `assetId` does not exist, or if the `output_format` and `cloud_type` combination is not supported for the asset's cloud provider." } }, "security": [], "x-scope": [ "external" ] } }, "/public_api/ciem/v1/access/source/{source_uai}": { "get": { "summary": "Retrieve the resources a source identity can access", "operationId": "ciemAccessGetBySource", "description": "Retrieves access data for a specific source identity or cloud resource, identified by its Unique Asset Identifier (UAI). Returns all access entries where this asset is the source of permissions, mapping out every resource it can reach.\n\nUse this endpoint to answer \"what can this identity access?\". Typical source assets are human identities and non-human identities such as compute instances (for example, `AWS::EC2::Instance`), service accounts, and serverless functions.\n\nSupports optional filtering, sorting, and pagination via an optional request body and query parameter.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security.", "tags": [ "CIEM" ], "parameters": [ { "name": "source_uai", "in": "path", "description": "The Unique Asset Identifier (UAI) of the source identity or cloud resource whose outbound access you want to retrieve.", "required": true, "schema": { "type": "string" }, "example": "dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277" }, { "name": "next_page_token", "in": "query", "description": "Base64-encoded pagination token from a previous response to fetch the next page of results.", "required": false, "schema": { "type": "string" } }, { "in": "header", "name": "x-xdr-auth-id", "schema": { "type": "string" }, "required": true, "description": "{api_key_id}" }, { "in": "header", "name": "Authorization", "schema": { "type": "string" }, "required": true, "description": "{api_key}" }, { "in": "header", "name": "Content-Type", "schema": { "type": "string", "enum": [ "application/json" ] }, "required": true, "description": "Specifies the request body format." } ], "requestBody": { "required": false, "description": "Optional request body for filtering and sorting results.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CiemAccessGetRequest" }, "examples": { "default": { "value": { "filter": { "AND": [ { "SEARCH_FIELD": "dest_cloud_resource_id", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "abc" } ] }, "sort": [ { "field": "dest_cloud_resource_id", "order": "DESC" } ] } } } } } }, "responses": { "200": { "description": "Successful response with access details for the specified source.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CiemAccessGetResponse" }, "examples": { "Example 1": { "value": { "FILTER_COUNT": 2, "TOTAL_COUNT": 150, "DATA": [ { "source_cloud_resource_name": "EC2 Instance", "source_cloud_resource_id": "i-0abc123def456", "source_cloud_resource_uai": "dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277", "source_cloud_resource_type": "AWS::EC2::Instance", "source_cloud_service_name": "Amazon EC2", "source_cloud_region": "us-east-1", "sourceCategory": "Non-human", "source_grouping_value": "group-1", "source_cloud_account_id": "123456789012", "source_cloud_account_name": "dev-account", "source_cloud_account_is_vendor": false, "sourceVendorName": "AWS", "dest_cloud_account_id": "987654321098", "dest_cloud_account_name": "prod-account", "dest_cloud_resource_name": "S3 Bucket", "dest_cloud_resource_id": "my-bucket", "dest_cloud_resource_uai": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "dest_cloud_resource_type": "AWS::S3::Bucket", "dest_cloud_service_name": "Amazon S3", "dest_cloud_region": "us-east-1", "destCategory": "Cloud Service Account", "dest_grouping_value": "group-2", "destination_access_labels": [], "grantedby_cloud_entity_name": "AdminRole", "grantedby_cloud_entity_id": "AROA1234567890EXAMPLE", "grantedby_cloud_entity_uai": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "grantedby_cloud_entity_type": "IAM Role", "granterCategory": "IAM Group", "granter_grouping_value": "group-3", "access_levels": [ "Read", "Write" ], "actions": { "Read": [ "s3:GetObject", "s3:ListBucket" ], "Write": [ "s3:PutObject" ] }, "actions_count": 2, "last_used": "2023-01-15T10:30:00Z", "account_access_transformed": "admin_access", "permission_scope": "Global", "excessive_policies_count": 5, "unused_actions_count": 10, "is_last_access_supported": true } ], "metadata": { "next_page_token": "eyJwYWdlIjogMn0=" } } } } } } }, "400": { "description": "Bad Request. Invalid parameters or pagination token.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 400, "err_msg": "Invalid Request", "err_extra": { "err_msg": "Invalid parameters or pagination token provided." } } } } } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 401, "err_msg": "Authentication Failed", "err_extra": { "err_msg": "Invalid API key or key ID provided. Please check your authentication credentials." } } } } } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 403, "err_msg": "Forbidden Access", "err_extra": { "err_msg": "The provided API key lacks the required RBAC permissions for this operation." } } } } } } } }, "404": { "description": "Not Found. The specified source UAI does not exist.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 404, "err_msg": "Not Found", "err_extra": { "err_msg": "The specified UAI does not exist." } } } } } } } }, "429": { "description": "Too Many Requests. The request rate limit has been exceeded.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 429, "err_msg": "Too Many Requests", "err_extra": { "err_msg": "The request rate limit has been exceeded. Please retry after a short delay." } } } } } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 500, "err_msg": "Internal Server Error", "err_extra": { "err_msg": "An internal server error occurred while processing the request." } } } } } } } }, "502": { "description": "Bad Gateway. The server received an invalid response from an upstream server.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 502, "err_msg": "Bad Gateway", "err_extra": { "err_msg": "The server received an invalid response from an upstream server." } } } } } } } }, "503": { "description": "Service Unavailable. The service is temporarily unavailable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 503, "err_msg": "Service Unavailable", "err_extra": { "err_msg": "The service is temporarily unavailable. Please retry later." } } } } } } } } } } }, "/public_api/ciem/v1/access/granter/{granter_uai}": { "get": { "summary": "Retrieve the access conferred by a permission-granting entity", "operationId": "ciemAccessGetByGranter", "description": "Retrieves access data for a specific granter entity, identified by its Unique Asset Identifier (UAI). A granter is the entity that confers permissions rather than the identity using them or the resource being reached. Returns all access entries mediated by this entity.\n\nUse this endpoint to answer \"what access does this permission grant confer, and to whom?\". Typical granter entities are permission constructs such as IAM roles, IAM groups, and IAM policies.\n\nSupports optional filtering, sorting, and pagination via an optional request body and query parameter.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security.", "tags": [ "CIEM" ], "parameters": [ { "name": "granter_uai", "in": "path", "description": "The Unique Asset Identifier (UAI) of the granter entity whose conferred access you want to retrieve.", "required": true, "schema": { "type": "string" }, "example": "dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277" }, { "name": "next_page_token", "in": "query", "description": "Base64-encoded pagination token from a previous response to fetch the next page of results.", "required": false, "schema": { "type": "string" } }, { "in": "header", "name": "x-xdr-auth-id", "schema": { "type": "string" }, "required": true, "description": "{api_key_id}" }, { "in": "header", "name": "Authorization", "schema": { "type": "string" }, "required": true, "description": "{api_key}" }, { "in": "header", "name": "Content-Type", "schema": { "type": "string", "enum": [ "application/json" ] }, "required": true, "description": "Specifies the request body format." } ], "requestBody": { "required": false, "description": "Optional request body for filtering and sorting results.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CiemAccessGetRequest" }, "examples": { "default": { "value": { "filter": { "AND": [ { "SEARCH_FIELD": "dest_cloud_resource_id", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "abc" } ] }, "sort": [ { "field": "dest_cloud_resource_id", "order": "DESC" } ] } } } } } }, "responses": { "200": { "description": "Successful response with access details for the specified granter.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CiemAccessGetResponse" }, "examples": { "Example 1": { "value": { "FILTER_COUNT": 2, "TOTAL_COUNT": 150, "DATA": [ { "source_cloud_resource_name": "EC2 Instance", "source_cloud_resource_id": "i-0abc123def456", "source_cloud_resource_uai": "dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277", "source_cloud_resource_type": "AWS::EC2::Instance", "source_cloud_service_name": "Amazon EC2", "source_cloud_region": "us-east-1", "sourceCategory": "Non-human", "source_grouping_value": "group-1", "source_cloud_account_id": "123456789012", "source_cloud_account_name": "dev-account", "source_cloud_account_is_vendor": false, "sourceVendorName": "AWS", "dest_cloud_account_id": "987654321098", "dest_cloud_account_name": "prod-account", "dest_cloud_resource_name": "S3 Bucket", "dest_cloud_resource_id": "my-bucket", "dest_cloud_resource_uai": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "dest_cloud_resource_type": "AWS::S3::Bucket", "dest_cloud_service_name": "Amazon S3", "dest_cloud_region": "us-east-1", "destCategory": "Cloud Service Account", "dest_grouping_value": "group-2", "destination_access_labels": [], "grantedby_cloud_entity_name": "AdminRole", "grantedby_cloud_entity_id": "AROA1234567890EXAMPLE", "grantedby_cloud_entity_uai": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "grantedby_cloud_entity_type": "IAM Role", "granterCategory": "IAM Group", "granter_grouping_value": "group-3", "access_levels": [ "Read", "Write" ], "actions": { "Read": [ "s3:GetObject", "s3:ListBucket" ], "Write": [ "s3:PutObject" ] }, "actions_count": 2, "last_used": "2023-01-15T10:30:00Z", "account_access_transformed": "admin_access", "permission_scope": "Global", "excessive_policies_count": 5, "unused_actions_count": 10, "is_last_access_supported": true } ], "metadata": { "next_page_token": "eyJwYWdlIjogMn0=" } } } } } } }, "400": { "description": "Bad Request. Invalid parameters or pagination token.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 400, "err_msg": "Invalid Request", "err_extra": { "err_msg": "Invalid parameters or pagination token provided." } } } } } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 401, "err_msg": "Authentication Failed", "err_extra": { "err_msg": "Invalid API key or key ID provided. Please check your authentication credentials." } } } } } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 403, "err_msg": "Forbidden Access", "err_extra": { "err_msg": "The provided API key lacks the required RBAC permissions for this operation." } } } } } } } }, "404": { "description": "Not Found. The specified granter UAI does not exist.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 404, "err_msg": "Not Found", "err_extra": { "err_msg": "The specified UAI does not exist." } } } } } } } }, "429": { "description": "Too Many Requests. The request rate limit has been exceeded.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 429, "err_msg": "Too Many Requests", "err_extra": { "err_msg": "The request rate limit has been exceeded. Please retry after a short delay." } } } } } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 500, "err_msg": "Internal Server Error", "err_extra": { "err_msg": "An internal server error occurred while processing the request." } } } } } } } }, "502": { "description": "Bad Gateway. The server received an invalid response from an upstream server.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 502, "err_msg": "Bad Gateway", "err_extra": { "err_msg": "The server received an invalid response from an upstream server." } } } } } } } }, "503": { "description": "Service Unavailable. The service is temporarily unavailable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 503, "err_msg": "Service Unavailable", "err_extra": { "err_msg": "The service is temporarily unavailable. Please retry later." } } } } } } } } } } }, "/public_api/ciem/v1/access/destination/{destination_uai}": { "get": { "summary": "Retrieve the identities that can access a destination resource", "operationId": "ciemAccessGetByDestination", "description": "Retrieves access data for a specific destination cloud resource, identified by its Unique Asset Identifier (UAI). Returns all access entries where this resource is the target, mapping out every identity that holds access to it.\n\nUse this endpoint to answer \"who has access to this resource?\". Typical destination assets are storage, data, and compute resources (for example, `AWS::S3::Bucket`), and the identities returned include both human users and non-human identities such as service accounts.\n\nSupports optional filtering, sorting, and pagination via an optional request body and query parameter.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security.", "tags": [ "CIEM" ], "parameters": [ { "name": "destination_uai", "in": "path", "description": "The Unique Asset Identifier (UAI) of the destination cloud resource whose inbound access you want to retrieve.", "required": true, "schema": { "type": "string" }, "example": "dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277" }, { "name": "next_page_token", "in": "query", "description": "Base64-encoded pagination token from a previous response to fetch the next page of results.", "required": false, "schema": { "type": "string" } }, { "in": "header", "name": "x-xdr-auth-id", "schema": { "type": "string" }, "required": true, "description": "{api_key_id}" }, { "in": "header", "name": "Authorization", "schema": { "type": "string" }, "required": true, "description": "{api_key}" }, { "in": "header", "name": "Content-Type", "schema": { "type": "string", "enum": [ "application/json" ] }, "required": true, "description": "Specifies the request body format." } ], "requestBody": { "required": false, "description": "Optional request body for filtering and sorting results.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CiemAccessGetRequest" }, "examples": { "default": { "value": { "filter": { "AND": [ { "SEARCH_FIELD": "dest_cloud_resource_id", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "abc" } ] }, "sort": [ { "field": "dest_cloud_resource_id", "order": "DESC" } ] } } } } } }, "responses": { "200": { "description": "Successful response with access details for the specified destination.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CiemAccessGetResponse" }, "examples": { "Example 1": { "value": { "FILTER_COUNT": 2, "TOTAL_COUNT": 150, "DATA": [ { "source_cloud_resource_name": "EC2 Instance", "source_cloud_resource_id": "i-0abc123def456", "source_cloud_resource_uai": "dac2bcda26b69887c8a9ae1bddb8a4ec6f3e258ad6a3c34a670608cc00478277", "source_cloud_resource_type": "AWS::EC2::Instance", "source_cloud_service_name": "Amazon EC2", "source_cloud_region": "us-east-1", "sourceCategory": "Non-human", "source_grouping_value": "group-1", "source_cloud_account_id": "123456789012", "source_cloud_account_name": "dev-account", "source_cloud_account_is_vendor": false, "sourceVendorName": "AWS", "dest_cloud_account_id": "987654321098", "dest_cloud_account_name": "prod-account", "dest_cloud_resource_name": "S3 Bucket", "dest_cloud_resource_id": "my-bucket", "dest_cloud_resource_uai": "a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", "dest_cloud_resource_type": "AWS::S3::Bucket", "dest_cloud_service_name": "Amazon S3", "dest_cloud_region": "us-east-1", "destCategory": "Cloud Service Account", "dest_grouping_value": "group-2", "destination_access_labels": [], "grantedby_cloud_entity_name": "AdminRole", "grantedby_cloud_entity_id": "AROA1234567890EXAMPLE", "grantedby_cloud_entity_uai": "b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3", "grantedby_cloud_entity_type": "IAM Role", "granterCategory": "IAM Group", "granter_grouping_value": "group-3", "access_levels": [ "Read", "Write" ], "actions": { "Read": [ "s3:GetObject", "s3:ListBucket" ], "Write": [ "s3:PutObject" ] }, "actions_count": 2, "last_used": "2023-01-15T10:30:00Z", "account_access_transformed": "admin_access", "permission_scope": "Global", "excessive_policies_count": 5, "unused_actions_count": 10, "is_last_access_supported": true } ], "metadata": { "next_page_token": "eyJwYWdlIjogMn0=" } } } } } } }, "400": { "description": "Bad Request. Invalid parameters or pagination token.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 400, "err_msg": "Invalid Request", "err_extra": { "err_msg": "Invalid parameters or pagination token provided." } } } } } } } }, "401": { "description": "Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 401, "err_msg": "Authentication Failed", "err_extra": { "err_msg": "Invalid API key or key ID provided. Please check your authentication credentials." } } } } } } } }, "403": { "description": "Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 403, "err_msg": "Forbidden Access", "err_extra": { "err_msg": "The provided API key lacks the required RBAC permissions for this operation." } } } } } } } }, "404": { "description": "Not Found. The specified destination UAI does not exist.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 404, "err_msg": "Not Found", "err_extra": { "err_msg": "The specified UAI does not exist." } } } } } } } }, "429": { "description": "Too Many Requests. The request rate limit has been exceeded.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 429, "err_msg": "Too Many Requests", "err_extra": { "err_msg": "The request rate limit has been exceeded. Please retry after a short delay." } } } } } } } }, "500": { "description": "Internal server error. A unified status for API communication type errors.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 500, "err_msg": "Internal Server Error", "err_extra": { "err_msg": "An internal server error occurred while processing the request." } } } } } } } }, "502": { "description": "Bad Gateway. The server received an invalid response from an upstream server.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 502, "err_msg": "Bad Gateway", "err_extra": { "err_msg": "The server received an invalid response from an upstream server." } } } } } } } }, "503": { "description": "Service Unavailable. The service is temporarily unavailable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "Example 1": { "value": { "reply": { "err_code": 503, "err_msg": "Service Unavailable", "err_extra": { "err_msg": "The service is temporarily unavailable. Please retry later." } } } } } } } } } } } }, "tags": [ { "name": "CIEM", "description": "APIs for searching and retrieving access information and least privilege access (LPA) recommendations within the Cloud Infrastructure Entitlement Management (CIEM) module." } ], "components": { "schemas": { "SortObject": { "type": "object", "required": [ "field", "order" ], "properties": { "field": { "type": "string", "description": "The field to sort by.", "enum": [ "account_access_transformed", "dest_cloud_account_id", "dest_cloud_account_name", "dest_cloud_resource_id", "dest_cloud_resource_name", "dest_cloud_resource_type", "dest_cloud_resource_uai", "dest_cloud_service_name", "excessive_policies_count", "grantedby_cloud_entity_id", "grantedby_cloud_entity_name", "grantedby_cloud_entity_type", "grantedby_cloud_entity_uai", "is_last_access_supported", "last_used", "permission_scope", "source_cloud_account_id", "source_cloud_account_is_vendor", "source_cloud_account_name", "source_cloud_resource_id", "source_cloud_resource_name", "source_cloud_resource_type", "source_cloud_resource_uai", "source_cloud_service_name", "unused_actions_count" ] }, "order": { "type": "string", "description": "The sort order.", "enum": [ "ASC", "DESC" ] } }, "example": { "field": "dest_cloud_resource_id", "order": "DESC" } }, "ErrorResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "err_code": { "type": "integer" }, "err_msg": { "type": "string" }, "err_extra": { "type": "object", "properties": { "err_msg": { "type": "string" } } } } } }, "example": { "reply": { "err_code": 500, "err_msg": "An error occurred while processing CIEM Access Search query", "err_extra": { "err_msg": "Internal server issue encountered during CIEM Access Search." } } } }, "CustomLeastPrivilegedAccessResponseDto": { "type": "object", "description": "Response containing the generated Least Privilege Access configuration for the asset.", "x-examples": {}, "properties": { "recommendationSnippets": { "$ref": "#/components/schemas/RecommendationSnippetsDto" }, "verdicts": { "type": "array", "description": "List of permission verdicts for each action associated with the asset. Each verdict indicates whether the action should be kept or removed based on usage during the lookback period.", "items": { "$ref": "#/components/schemas/LeastPrivilegedPermissionVerdict" } }, "recommendedActionType": { "type": "string", "description": "The recommended remediation action based on the evaluation of the asset's permissions.\n- `applySnippets` — The asset has excess permissions. Apply the configuration snippets in `recommendationSnippets` to enforce least-privilege access.\n- `removeAllPolicies` — No actions were observed during the lookback period. Remove all policies or roles currently assigned to the asset.\n- `noActionRequired` — The asset's current permissions already satisfy least-privilege requirements. No remediation is needed.\n- `manuallyRemoveUnusedActions` — The asset has unused permissions that cannot be automatically remediated using configuration snippets. Review and remove the unused permissions manually.", "enum": [ "applySnippets", "removeAllPolicies", "noActionRequired", "manuallyRemoveUnusedActions" ] } } }, "RecommendationSnippetsDto": { "type": "object", "description": "Remediation configuration snippets for applying the recommended least-privilege permissions. Depending on the requested `output_format`, one or more fields are populated.", "properties": { "json": { "type": "array", "description": "Remediation snippets in JSON format. Returned when `output_format=JSON` or `output_format=ALL`. Supported for AWS, Azure, and GCP.", "items": { "type": "string", "description": "A serialized JSON string representing a single cloud API call. Parse this string as JSON to access the `url` and `body` fields.", "example": "\"{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Resource\\\":[\\\"arn:aws:logs:us-east-2:113505086193:log-group:/aws/lambda/zxsds:*\\\"],\\\"Action\\\":[\\\"logs:PutLogEvents\\\"],\\\"Condition\\\":{},\\\"Effect\\\":\\\"Allow\\\"}]}\"" } }, "terraform": { "type": "array", "description": "Remediation snippets in Terraform format. Returned when `output_format=TERRAFORM` or `output_format=ALL`. Supported for AWS, Azure, and GCP.", "items": { "type": "string", "description": "A Terraform HCL resource block string defining the least-privilege role or policy.", "example": "\"resource \"aws_iam_policy\" \"least-privileged-policy\" { name = \"prisma_arn:aws:iam::123456789012:role/service-role/example-lambda-role-a1b2c3d4_least_privileged_policy_2025-06-15T09:30:00.000000000\" path = \"/\" description = \"My least privileged policy\" # Terraform's \"jsonencode\" function converts a # Terraform expression result to valid JSON syntax. policy = jsonencode({ \"Version\": \"2012-10-17\", \"Statement\": [ { \"Resource\": [ \"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/example-lambda-function:*\" ], \"Action\": [ \"logs:PutLogEvents\" ], \"Condition\": {}, \"Effect\": \"Allow\" } ] }) }\"" } }, "cloudFormation": { "type": "array", "description": "Remediation snippets in AWS CloudFormation format. Returned when `output_format=CF` or `output_format=ALL`. Supported for AWS only.", "items": { "type": "string", "description": "An AWS CloudFormation template fragment string defining the least-privilege IAM policy or role.", "example": "\"{\"Type\":\"AWS::IAM::Policy\",\"Properties\":{\"PolicyDocument\":{\"Version\":\"2012-10-17\",\"Statement\":[{\"Resource\":[\"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/example-lambda-function:*\"],\"Action\":[\"logs:PutLogEvents\"],\"Condition\":{},\"Effect\":\"Allow\"}]},\"PolicyName\":\"prisma_arn:aws:iam::123456789012:role/service-role/example-lambda-role-a1b2c3d4_least_privileged_policy_2025-06-15T09:30:00.000000000\"}}\"" } }, "cli": { "type": "array", "description": "Remediation snippets as Google Cloud CLI (gcloud) commands. Returned when `output_format=CLI` or `output_format=ALL`. Supported for GCP only.", "items": { "type": "string", "example": "\"gcloud projects add-iam-policy-binding 'example-gcp-project-01' \\ --member='serviceAccount:example-service-account@example-gcp-project-01.iam.gserviceaccount.com' \\ --role='projects/example-gcp-project-01/roles/cortex_lpa_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6'\"" } } } }, "LeastPrivilegedPermissionVerdict": { "type": "object", "description": "List of permission verdicts for actions associated with the asset. Each verdict indicates whether an action should be retained or removed based on its usage during the specified lookback period.", "properties": { "actionName": { "type": "string", "description": "The cloud permission action that was evaluated. The format varies by cloud provider (for example, `s3:PutObject` for AWS, `Microsoft.Compute/disks/write` for Azure, or `compute.instances.get` for GCP).", "example": "Microsoft.Compute/disks/write" }, "policyName": { "type": "string", "description": "Name of the policy or role that grants the evaluated action.", "example": "ExampleReaderRole-o-a-00001-b2c3d4e5f6" }, "recommendation": { "type": "string", "description": "Recommended action for the evaluated permission.\n- `Keep` — The action was used during the lookback period and should be retained.\n- `Remove` — The action was not used during the lookback period and should be removed to enforce least privilege.", "enum": [ "Keep", "Remove" ], "example": "Remove" }, "source": { "type": "string", "description": "Source of the access data used to determine the recommendation.\n- `CIEM_LAST_ACCESS` — Based on last-access activity collected by CIEM.\n- `ACCESS_ADVISOR` — Based on access advisor data provided by the cloud provider (for example, AWS IAM Access Advisor), which reports the last time a service was accessed.", "enum": [ "CIEM_LAST_ACCESS", "ACCESS_ADVISOR" ], "example": "CIEM_LAST_ACCESS" } } }, "CiemAccessGetRequest": { "type": "object", "description": "Optional request body for CIEM access GET endpoints, supporting filtering and sorting.", "properties": { "filter": { "type": "object", "description": "Optional filters to apply to the results.", "properties": { "AND": { "type": "array", "description": "A list of filter conditions combined with AND logic.", "items": { "$ref": "#/components/schemas/GetFilterObject" } } } }, "sort": { "type": "array", "description": "Optional sorting criteria for the results. The sort array is passed through as-is to the underlying Cortex Platform data endpoint.", "items": { "$ref": "#/components/schemas/SortObject" }, "minItems": 1, "maxItems": 1 } }, "example": { "filter": { "AND": [ { "SEARCH_FIELD": "dest_cloud_resource_id", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "abc" } ] }, "sort": [ { "field": "dest_cloud_resource_id", "order": "DESC" } ] } }, "CiemAccessGetResponse": { "type": "object", "description": "Response object for CIEM access GET endpoints.", "properties": { "FILTER_COUNT": { "type": "integer", "description": "The number of results matching the applied filters.", "format": "int32" }, "TOTAL_COUNT": { "type": "integer", "description": "The total number of available access records.", "format": "int32" }, "DATA": { "type": "array", "description": "An array of access entries matching the specified UAI.", "items": { "$ref": "#/components/schemas/CiemAccessGetEntry" } }, "metadata": { "type": "object", "description": "Pagination metadata. The `next_page_token` field is present only when additional pages are available.", "properties": { "next_page_token": { "type": "string", "description": "A base64-encoded token to retrieve the next page of results. Absent on the last page." } } } }, "example": { "FILTER_COUNT": 0, "TOTAL_COUNT": 49285433, "DATA": [], "metadata": {} } }, "CiemAccessGetEntry": { "type": "object", "description": "Represents a single access entry returned by the CIEM access GET endpoints.", "properties": { "source_cloud_resource_name": { "type": "string", "description": "Name of the source cloud resource" }, "source_cloud_resource_id": { "type": "string", "description": "Source cloud resource ID" }, "source_cloud_resource_uai": { "type": "string", "description": "Source cloud resource UAI" }, "source_cloud_resource_type": { "type": "string", "description": "Type of the source cloud resource" }, "source_cloud_service_name": { "type": "string", "description": "Name of the source cloud service" }, "source_cloud_region": { "type": "string", "description": "Source cloud region" }, "sourceCategory": { "type": "string", "description": "Category of the source entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.", "enum": [ "Human", "Non-human", "Cloud Service Account", "IAM Group", "IAM Policy" ] }, "source_grouping_value": { "type": "string", "description": "Grouping value for the source entity. For internal use; not intended for external consumption." }, "source_cloud_account_id": { "type": "string", "description": "Source cloud account ID" }, "source_cloud_account_name": { "type": "string", "description": "Name of the source cloud account" }, "source_cloud_account_is_vendor": { "type": "boolean", "description": "Indicates if the source account is a known vendor" }, "sourceVendorName": { "type": "string", "description": "Name of the source vendor" }, "dest_cloud_account_id": { "type": "string", "description": "Destination cloud account ID" }, "dest_cloud_account_name": { "type": "string", "description": "Name of the destination cloud account" }, "dest_cloud_resource_name": { "type": "string", "description": "Name of the destination cloud resource" }, "dest_cloud_resource_id": { "type": "string", "description": "Destination cloud resource ID" }, "dest_cloud_resource_uai": { "type": "string", "description": "Destination cloud resource UAI" }, "dest_cloud_resource_type": { "type": "string", "description": "Type of the destination cloud resource" }, "dest_cloud_service_name": { "type": "string", "description": "Name of the destination cloud service" }, "dest_cloud_region": { "type": "string", "description": "Destination cloud region" }, "destCategory": { "type": "string", "description": "Category of the destination entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.", "enum": [ "Human", "Non-human", "Cloud Service Account", "IAM Group", "IAM Policy" ] }, "dest_grouping_value": { "type": "string", "description": "Grouping value for the destination entity. For internal use; not intended for external consumption." }, "destination_access_labels": { "type": "array", "description": "Labels describing access to data", "items": { "type": "string" } }, "grantedby_cloud_entity_name": { "type": "string", "description": "Name of the cloud entity that granted access" }, "grantedby_cloud_entity_id": { "type": "string", "description": "Granted by cloud entity ID" }, "grantedby_cloud_entity_uai": { "type": "string", "description": "Granted by cloud entity UAI" }, "grantedby_cloud_entity_type": { "type": "string", "description": "Type of the cloud entity that granted access" }, "granterCategory": { "type": "string", "description": "Category of the granter entity. Valid values include:\n- `Human`: All cloud, identity provider (IdP), and platform users.\n- `Non-human`: Machine identities that can assume permissions and perform cloud Identity and Access Management (IAM) actions such as VMs and functions.\n- `Cloud Service Account`: A category unifying AWS roles, Microsoft Azure service accounts and managed identities, and GCP service accounts.\n- `IAM Group`: IAM group, which is a collection of IAM users.\n- `IAM Policy`: Permission documents, such as AWS policies, Azure roles, and GCP roles.", "enum": [ "Human", "Non-human", "Cloud Service Account", "IAM Group", "IAM Policy" ] }, "granter_grouping_value": { "type": "string", "description": "Grouping value for the granter entity. For internal use; not intended for external consumption." }, "access_levels": { "type": "array", "description": "Access levels granted", "items": { "type": "string" } }, "actions": { "type": "object", "description": "Map of access levels to their permitted actions. Each key is an access level name, and the value is an array of action strings within that access level.", "additionalProperties": { "type": "array", "items": { "type": "string" } } }, "actions_count": { "type": "integer", "description": "Total number of actions" }, "last_used": { "type": "string", "format": "date-time", "description": "Timestamp of when access was last used" }, "account_access_transformed": { "type": "string", "description": "Transformed account access details" }, "permission_scope": { "type": "string", "description": "Scope of the permission" }, "excessive_policies_count": { "type": "integer", "description": "Number of excessive policies" }, "unused_actions_count": { "type": "integer", "description": "Number of unused actions" }, "is_last_access_supported": { "type": "boolean", "description": "Indicates if last access tracking is supported" } } }, "GetFilterObject": { "type": "object", "description": "Filter object for the CIEM access GET endpoints.", "required": [ "SEARCH_FIELD", "SEARCH_TYPE", "SEARCH_VALUE" ], "properties": { "SEARCH_FIELD": { "type": "string", "description": "Identifies the field to filter.", "enum": [ "access_levels", "account_access_transformed", "dest_cloud_account_id", "dest_cloud_account_name", "dest_cloud_region", "dest_cloud_resource_id", "dest_cloud_resource_name", "dest_cloud_resource_type", "dest_cloud_resource_uai", "dest_cloud_service_name", "destCategory", "destination_access_labels", "excessive_policies_count", "grantedby_cloud_entity_id", "grantedby_cloud_entity_name", "grantedby_cloud_entity_type", "grantedby_cloud_entity_uai", "granterCategory", "last_used", "permission_scope", "source_cloud_account_id", "source_cloud_account_is_vendor", "source_cloud_account_name", "source_cloud_region", "source_cloud_resource_id", "source_cloud_resource_name", "source_cloud_resource_type", "source_cloud_resource_uai", "source_cloud_service_name", "sourceCategory", "sourceVendorName", "unused_actions_count" ] }, "SEARCH_TYPE": { "type": "string", "description": "Identifies the comparison operator you want to use for this filter. Valid values are:\n- `EQ`", "enum": [ "EQ" ] }, "SEARCH_VALUE": { "type": "string", "description": "Value that this filter must match." } }, "example": { "SEARCH_FIELD": "dest_cloud_resource_id", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "abc" } } } } }