{ "openapi": "3.0.3", "x-hideTryItPanel": true, "info": { "title": "Compliance Controls API", "description": " API for managing compliance controls, rules and retrieving compliance results.\n\nRBAC permissions:\n- **`platform_compliance_view`** — required for all `GET` endpoints\n- **`platform_compliance_edit`** — required for all `POST`, `DELETE` endpoints\n\n## Pagination\n\n- **PAPI** list endpoints return paginated results using `offset` / `limit` query parameters\n wrapped in a standard envelope containing `total_count`, `results`, and `next_offset`.\n\n## Rule Association\n\nControls can optionally include a `rule_ids` array when being created or updated.\nWhen provided on create, the given rules are associated with the newly created control.\nWhen provided on update, the control's existing rule associations are completely replaced\nby the provided list.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "version": "Cortex Cloud", "contact": { "email": "docs-cortex@paloaltonetworks.com", "name": "Cortex Documentation Team", "url": "https://cortex-docs.paloaltonetworks.com/" }, "license": { "name": "Proprietary", "url": "https://www.paloaltonetworks.com/legal" } }, "servers": [ { "url": "https://{tenant}.xdr.{region}.paloaltonetworks.com", "description": "Cortex tenant", "variables": { "tenant": { "default": "api", "description": "Tenant-specific subdomain" }, "region": { "default": "us", "description": "Deployment region", "enum": [ "us", "eu", "uk", "sg", "jp", "ca", "au", "in", "gov" ] } } } ], "paths": { "/public_api/v1/compliance/get_assessment_profiles": { "post": { "summary": "Get assessment profiles", "description": "An assessment profile uses a standard to run scans on an asset group to check whether the assets adhere to the standard.\n\nRetrieve compliance assessment profiles with optional filtering, sorting and pagination.\n- The response is concatenated using AND condition (OR is not supported)\n- The maximum result set size is >100\n- Offset is the zero-based number of assessment profiles from the start of the result set\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getAssessmentProfiles", "tags": [ "Assessment profiles" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAssessmentProfilesRequest" }, "examples": { "Example 1": { "value": { "request_data": { "search_from": 0, "search_to": 50, "sort": { "field": "report_type", "keyword": "desc" }, "filters": [ { "field": "creation_time", "operator": "gte", "value": 0 }, { "field": "name", "operator": "eq", "value": "John" } ] } } } } } } }, "responses": { "200": { "description": "Successfully retrieved assessment profiles", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AssessmentProfilesResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/get_assessment_profile": { "post": { "summary": "Get assessment profile by ID", "description": "An assessment profile uses a standard to run scans on an asset group to check whether the assets adhere to the standard.\n\nGet details of the assessment profile specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getAssessmentProfile", "tags": [ "Assessment profiles" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "Assessment profile ID" } } } } }, "example": { "request_data": { "id": "eee175cb00ef4da4a0e3091b1ee77368" } } } } }, "responses": { "200": { "description": "Successfully retrieved assessment profile", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AssessmentProfileResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/add_assessment_profile": { "post": { "summary": "Add assessment profile", "description": "Create a custom compliance assessment profile that is tailored to your own business needs and organizational policies.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "addAssessmentProfile", "tags": [ "Assessment profiles" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "profile_name", "asset_group_id", "standard_id" ], "properties": { "profile_name": { "type": "string", "description": "Name of the assessment profile" }, "asset_group_id": { "type": "string", "description": "Asset Group ID" }, "standard_id": { "type": "string", "description": "Standard ID" }, "description": { "type": "string", "description": "Description of the assessment profile" }, "report_targets": { "type": "array", "description": "Assessment profile targets", "items": { "type": "string", "format": "email" } }, "report_type": { "type": "string", "description": "Assessment profile report type. Valid values include:\n- `ALL`\n- `PDF`\n- `CSV`\n- `NONE` ", "enum": [ "ALL", "PDF", "CSV", "NONE" ] }, "evaluation_frequency": { "type": "string", "description": "Assessment report evaluation frequency", "format": "cron", "example": "0 12 * * *" } } } } }, "example": { "request_data": { "profile_name": "profile example", "description": "profile description example", "evaluation_frequency": "0 12 * * *", "asset_group_id": "3", "report_type": "ALL", "standard_id": "532ac684-451c-5c789-b1a8-7c325b678843", "report_targets": [ "user@company.com" ] } } } } }, "responses": { "200": { "description": "Successfully created assessment profile", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "description": "Whether the assessment profile creation succeeded" } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "409": { "$ref": "#/components/responses/Conflict" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/edit_assessment_profile": { "post": { "summary": "Edit assessment profile", "description": "Edit an existing compliance custom assessment profile.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "editAssessmentProfile", "tags": [ "Assessment profiles" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "": { "$ref": "#/components/schemas/EditAssessmentProfileRequest" } } }, "examples": { "Example 1": { "value": { "request_data": { "id": "48e2f6a9fdc049479e9c6a8eda0bd163", "control_name": "Control 1" } } } } } } }, "responses": { "200": { "description": "Successfully updated assessment profile", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean" } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/Conflict" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/delete_assessment_profile": { "post": { "summary": "Delete assessment profile", "description": "Delete an assessment profile specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "deleteAssessmentProfile", "tags": [ "Assessment profiles" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "Assessment profile ID" } } } } }, "example": { "request_data": { "id": "f9f764717b284e9483f9c1210ed3149d" } } } } }, "responses": { "200": { "description": "Successfully deleted assessment profile", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "description": "Whether the assessment profile deletion succeeded" } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/get_assessment_results": { "post": { "summary": "Get assessment profile results", "description": "Retrieve assessment profile results with optional filtering based on the last successful evaluation.\n\n**Filtering Support:**\n- Field (`labels`): `contains`, `not_contains`\n\n**Note:** This API does not support sorting or pagination. Sorting will not take effect even if it is specified in the payload. The results will not return the results based on sorting'\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getAssessmentProfileResults", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAssessmentResultsRequest" }, "examples": { "Example 1": { "value": { "request_data": { "filters": [ { "field": "labels", "operator": "contains", "value": "aws" } ] } } } } } } }, "responses": { "200": { "description": "Successfully retrieved assessment profile results", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AssessmentResultsResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "security": [ { "XDRAuth": [], "XDRAuthToken": [] } ], "tags": [ "Assessment results" ] }, "parameters": [] }, "/public_api/v1/compliance/get_controls": { "post": { "summary": "Get compliance controls (v1)", "description": "Compliance controls are measures related to the standard that ensure compliance and mitigate risks. Controls are built from one or more rules, the specific checks that run on an asset. Controls can be grouped into categories, for example RBAC and Pod security.\n\nRetrieve compliance control details with optional filtering, sorting and pagination.\n- The response is concatenated using AND condition (OR is not supported)\n- The maximum result set size is >100\n- Offset is the zero-based number of assessment profiles from the start of the result set\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getControls", "tags": [ "Controls" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "filters": { "type": "array", "items": { "$ref": "#/components/schemas/Filter" } }, "sort": { "type": "object", "properties": { "field": { "type": "string", "enum": [ "name", "category", "subcategory", "creation_time", "created_by", "modified_by", "modification_time", "id" ], "default": "creation_time", "description": "Sort according to this field" }, "keyword": { "type": "string", "enum": [ "asc", "desc" ], "default": "asc", "description": "Sort in ascending (`asc`) or descending (`desc`) order" } } }, "search_from": { "type": "integer", "minimum": 0, "default": 0, "description": "Integer representing the starting offset within the query result set from which you want compliance controls returned.\nCompliance controls are returned as a zero-based list. Any compliance control indexed less than this value is not returned in the final result set and defaults to zero." }, "search_to": { "type": "integer", "minimum": 1, "default": 100, "description": "Integer representing the end offset within the result set after which you do not want compliance controls returned.\nCompliance controls in the compliance control list that are indexed higher than this value are not returned in the final results set. Defaults to >100, which returns all compliance controls to the end of the list." } } } } }, "examples": { "basic_filter": { "summary": "Basic name filter", "value": { "request_data": { "filters": [ { "field": "name", "operator": "contains", "value": "Access Enforcement" } ] } } }, "custom_controls": { "summary": "Get custom controls only", "value": { "request_data": { "filters": [ { "field": "is_custom", "operator": "in", "value": [ "yes" ] } ] } } }, "time_range": { "summary": "Filter by creation time range", "value": { "request_data": { "filters": [ { "field": "creation_time", "operator": "gte", "value": 1640995200000 }, { "field": "creation_time", "operator": "lte", "value": 1672531200000 } ] } } } } } } }, "responses": { "200": { "description": "Successfully retrieved controls", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "total_count": { "type": "integer", "description": "Total number of controls" }, "result_count": { "type": "integer", "description": "Number of controls matching filters + paging" }, "controls": { "type": "array", "items": { "$ref": "#/components/schemas/Control" } } } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/get_control": { "post": { "summary": "Get compliance control by ID (v1)", "description": "Get details of the compliance control specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getControl", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "Compliance control ID" } } } } }, "examples": { "Example 1": { "value": { "request_data": { "id": "ede175cb30ef4dd4a0e3031b1ee77868" } } } } } } }, "responses": { "200": { "description": "Successfully retrieved control", "content": { "application/json": { "schema": { "type": "object", "properties": { "control": { "type": "object", "properties": { "CATEGORY": { "type": "string" }, "CATEGORY_DESCRIPTION": { "type": "string" }, "SUBCATEGORY": { "type": "string" }, "SUBCATEGORY_DESCRIPTION": { "type": "string" }, "CONTROL_ID": { "type": "string" }, "STANDARDS": { "type": "array", "items": { "type": "string" } }, "CONTROL_NAME": { "type": "string" }, "SEVERITY": { "type": "string" }, "SUPPORTED": { "type": "boolean" }, "INSERTION_TIME": { "type": "integer" }, "MODIFICATION_TIME": { "type": "integer" }, "MODIFIED_BY": { "type": "null" }, "CREATED_BY": { "type": "string" }, "DESCRIPTION": { "type": "string" }, "MITIGATION": { "type": "null" }, "ADDITIONAL_DATA": { "type": "array", "items": { "type": "object", "properties": {} } }, "COMPLIANCE_RULES": { "type": "array", "items": { "type": "object", "properties": {} } }, "RULES": { "type": "integer" }, "REVISION": { "type": "string" }, "IMPACT": { "type": "null" }, "AUTOMATION_STATUS": { "type": "string" }, "AUDIT_PROCEDURE": { "type": "null" }, "ENABLED": { "type": "boolean" }, "IS_CUSTOM": { "type": "boolean" }, "STATUS": { "type": "string" } } } }, "x-examples": { "Example 1": { "control": { "CATEGORY": "Initial Setup", "CATEGORY_DESCRIPTION": "", "SUBCATEGORY": "Filesystem Configuration", "SUBCATEGORY_DESCRIPTION": "", "CONTROL_ID": "deee0446ef984486b1a9ce37e379dd83", "STANDARDS": [ "standard name" ], "CONTROL_NAME": "control name", "SEVERITY": "SEV_020_LOW", "SUPPORTED": false, "INSERTION_TIME": 1746966658000, "MODIFICATION_TIME": 1746966658000, "MODIFIED_BY": null, "CREATED_BY": "Generic Name", "DESCRIPTION": "", "MITIGATION": null, "ADDITIONAL_DATA": [], "COMPLIANCE_RULES": [], "RULES": 0, "REVISION": "8514820482740167575", "IMPACT": null, "AUTOMATION_STATUS": "automated", "AUDIT_PROCEDURE": null, "ENABLED": true, "IS_CUSTOM": true, "STATUS": "ACTIVE" } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/add_control": { "post": { "summary": "Add new control (v1)", "description": "Create a custom compliance control.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "addControl", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "control_name", "category" ], "properties": { "control_name": { "type": "string", "description": "Name of the compliance control" }, "description": { "type": "string", "description": "Description of the compliance control" }, "category": { "type": "string", "description": "Compliance control category" }, "subcategory": { "type": "string", "description": "Compliance control subcategory" } } } } }, "examples": { "Example 1": { "value": { "request_data": { "control_name": "control name", "category": "Network Configuration", "subcategory": "4.2" } } } } } } }, "responses": { "200": { "description": "Control added successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "description": "Whether the compliance control creation was successful" } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/edit_control": { "post": { "summary": "Edit existing control (v1)", "description": "Edit an existing compliance custom compliance control.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "editControl", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "Compliance control ID" }, "control_name": { "type": "string", "description": "Name of the compliance control" }, "description": { "type": "string", "description": "Description of the compliance control" }, "category": { "type": "string", "description": "Compliance control category" }, "subcategory": { "type": "string", "description": "Compliance control subcategory" } } } } }, "examples": { "Example 1": { "value": { "request_data": { "id": "48e2f6a9fcc049579e9c6b8eda0bd123", "control_name": "Great new name" } } } } } } }, "responses": { "200": { "description": "Control updated successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "description": "Whether the custom compliance control was edited successfully" } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/delete_control": { "post": { "summary": "Delete control (v1)", "description": "Delete a compliance control specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "deleteControl", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "Compliance control ID" } } } } }, "examples": { "Example 1": { "value": { "request_data": { "id": "f9f744717b284e9383f9c1210ad3143d" } } } } } } }, "responses": { "200": { "description": "Control deleted successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "description": "Whether the compliance control was successfully deleted" } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/add_rules_to_control": { "post": { "summary": "Add compliance rules to a compliance control", "description": "Add compliance rules to the specific compliance control. \n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "addRulesToControl", "tags": [ "Rules" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "control_id", "rules" ], "properties": { "control_id": { "type": "string", "description": "Compliance control ID" }, "rules": { "type": "array", "items": { "$ref": "#/components/schemas/Rule" } } } } } }, "examples": { "Example 1": { "value": { "request_data": { "control_id": "0b0b5354d06d43ffc3d7465858378135", "rules": [ { "name": "Rule 1", "description": "Description 1", "type": "Identity", "logical_id": "2b16a9f3-260x2-4xsf0cc-a9091", "severity": "high", "scannable_assets": [ "KUBERNETES_NODE" ], "remediation_steps": "Run the following command...", "generate_findings": true, "generate_issues": true, "generate_scan_logs": true }, { "name": "Rule 2", "description": "Description 2", "type": "Identity", "logical_id": "2b16a9f3-cc2x602-4vvxXccXfn0c1", "scannable_assets": [ "KUBERNETES_NODE" ], "generate_findings": false, "generate_issues": true, "generate_scan_logs": true } ] } } } } } } }, "responses": { "200": { "description": "Rules added successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "description": "Whether the rules were added successfully" } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/delete_rules_from_control": { "post": { "summary": "Delete rules from control", "description": "Remove specific rules from the specified compliance control.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "deleteRulesFromControl", "tags": [ "Rules" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "control_id", "rules_ids" ], "properties": { "control_id": { "type": "string", "description": "Compliance control ID" }, "rules_ids": { "type": "array", "description": "List of rule IDs to delete", "items": { "type": "string" } } } } } }, "examples": { "Example 1": { "value": { "request_data": { "control_id": "48e2f6a9cdc049479e3c6a8eda3bd161", "rules_ids": [ "2b26a9f3-ca2x602-4vvxXccXf3c1" ] } } } } } } }, "responses": { "200": { "description": "Rules deleted successfully", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean", "description": "Whether the rules were successfully deleted from the compliance control" } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/get_control_categories_and_subcategories": { "post": { "summary": "Get categories and subcategories (v1)", "description": "Retrieve available compliance control categories and subcategories.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getCategoriesAndSubcategories", "tags": [ "Categories" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object" } } }, "examples": { "Example 1": { "value": { "request_data": {} } } } } } }, "responses": { "200": { "description": "Successfully retrieved categories and subcategories", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "object", "properties": { "categories": { "type": "array", "items": { "type": "string" }, "description": "Available control categories" }, "subcategories": { "type": "array", "items": { "type": "string" }, "description": "Available control subcategories" } } } } } } } } } }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/get_control_by_revision": { "post": { "summary": "Get control by revision (v1)", "description": "Get details of the compliance control specified by its revision ID, including inactive controls.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getControlByRevision", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "control_revision" ], "properties": { "control_revision": { "type": "string", "description": "Control revision ID" } } } } }, "examples": { "Example 1": { "value": { "request_data": { "control_revision": "4983640851729713422" } } } } } } }, "responses": { "200": { "description": "Successfully retrieved control", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "control": { "$ref": "#/components/schemas/Control" } } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/get_control_failed_results": { "post": { "summary": "Get control failed results", "description": "Get the failed findings and issues for a specific compliance control.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getControlFailedResults", "tags": [ "Results" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "control_revision", "assessment_profile_revision", "last_evaluation_time" ], "properties": { "control_revision": { "type": "string", "description": "Compliance control revision ID" }, "assessment_profile_revision": { "type": "string", "description": "Assessment profile revision ID" }, "last_evaluation_time": { "type": "integer", "format": "int64", "description": "Last evaluation timestamp (epoch time in milliseconds)" } } } } } } } }, "responses": { "200": { "description": "Successfully retrieved failed results", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "object", "example": { "reply": { "data": { "findings": { "ids": [ "3579087545800876543456789" ], "value": 1 }, "issues": { "ids": [], "value": 0 } } } }, "properties": { "findings": { "type": "array", "items": { "$ref": "#/components/schemas/Findings" } }, "issues": { "type": "array", "items": { "$ref": "#/components/schemas/Issues" } } } } } } } }, "examples": { "Example 1": { "value": { "reply": { "data": { "findings": { "ids": [ "45667890n85678908765456789bkk" ], "value": 1 }, "issues": [ { "name": "SEV_020_LOW", "pretty_name": "Low", "value": 0, "ids": [] }, { "name": "SEV_030_MEDIUM", "pretty_name": "Medium", "value": 0, "ids": [] }, { "name": "SEV_040_HIGH", "pretty_name": "High", "value": 1, "ids": [ "4537893ijnmskiu2y6t5rxt7y789ok" ] }, { "name": "SEV_050_CRITICAL", "pretty_name": "Critical", "value": 0, "ids": [] } ] } } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/get_rule_failed_results": { "post": { "summary": "Get rule failed results", "description": "Get the failed findings and issues for a specific rule.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getRuleFailedResults", "tags": [ "Results" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "control_revision", "assessment_profile_revision", "last_evaluation_time", "rule_id" ], "properties": { "control_revision": { "type": "string", "description": "Compliance control revision ID" }, "assessment_profile_revision": { "type": "string", "description": "Assessment profile revision ID" }, "last_evaluation_time": { "type": "integer", "format": "int64", "description": "Last evaluation timestamp (epoch time in milliseconds)" }, "rule_id": { "type": "string", "description": "Rule ID" } } } } } } } }, "responses": { "200": { "description": "Successfully retrieved rule failed results", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "data": { "type": "object", "properties": { "findings": { "type": "array", "items": { "$ref": "#/components/schemas/Findings" } }, "issues": { "type": "array", "items": { "$ref": "#/components/schemas/Issues" } } } } } } } }, "examples": { "Example 1": { "value": { "reply": { "data": { "findings": { "ids": [ "45667890n85678908765456789bkk" ], "value": 1 }, "issues": [ { "name": "SEV_020_LOW", "pretty_name": "Low", "value": 0, "ids": [] }, { "name": "SEV_030_MEDIUM", "pretty_name": "Medium", "value": 0, "ids": [] }, { "name": "SEV_040_HIGH", "pretty_name": "High", "value": 1, "ids": [ "4567893ijnmskiu7y6t5rxt6y789ok" ] }, { "name": "SEV_050_CRITICAL", "pretty_name": "Critical", "value": 0, "ids": [] } ] } } } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/get_reports": { "post": { "summary": "Get compliance reports", "description": "Retrieve archived compliance assessment reports with optional filtering, sorting and pagination.\n- The response is concatenated using AND condition (OR is not supported)\n- The maximum result set size is >100\n- Offset is the zero-based number of assessment profiles from the start of the result set\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.\n", "operationId": "getReports", "tags": [ "Reports" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "properties": { "filters": { "type": "array", "description": "Optional filters to apply to the reports", "items": { "$ref": "#/components/schemas/ReportFilter" } }, "sort": { "type": "object", "description": "Sorting configuration", "properties": { "field": { "type": "string", "enum": [ "standard_name", "assessment_profile_name", "asset_group_name", "score", "evaluation_time" ], "default": "evaluation_time", "description": "Field to sort by" }, "keyword": { "type": "string", "enum": [ "asc", "desc" ], "default": "asc", "description": "Sort direction" } } }, "search_from": { "type": "integer", "minimum": 0, "default": 0, "description": "Starting index for pagination" }, "search_to": { "type": "integer", "minimum": 1, "description": "Ending index for pagination" } } } } }, "examples": { "basic_request": { "summary": "Basic request with pagination", "value": { "request_data": { "search_from": 0, "search_to": 1, "filters": [ { "field": "standard_name", "operator": "neq", "value": "PCI DSS v4.0.1" } ] } } }, "filtered_by_score": { "summary": "Filter reports by score range", "value": { "request_data": { "search_from": 0, "search_to": 25, "filters": [ { "field": "score", "operator": "gte", "value": 80 } ], "sort": { "field": "score", "keyword": "desc" } } } }, "filtered_by_standard": { "summary": "Filter by specific compliance standard", "value": { "request_data": { "search_from": 0, "search_to": 50, "filters": [ { "field": "standard_name", "operator": "eq", "value": "SOC2" }, { "field": "evaluation_time", "operator": "gte", "value": 1640995200000 } ], "sort": { "field": "evaluation_time", "keyword": "desc" } } } } } } } }, "responses": { "200": { "description": "Successfully retrieved compliance reports", "content": { "application/json": { "schema": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "total_count": { "type": "integer", "description": "Total number of reports in the archive" }, "result_count": { "type": "integer", "description": "Number of reports returned in this response (filter + paging)" }, "filter_count": { "type": "integer", "description": "Number of reports matching the filter criteria" }, "reports": { "type": "array", "description": "List of compliance reports", "items": { "$ref": "#/components/schemas/ComplianceReport" } } } } } } } } }, "400": { "$ref": "#/components/responses/ReportsBadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } } }, "/public_api/v1/compliance/get_standards": { "post": { "summary": "Get compliance standards (v1)", "description": "Retrieve compliance standards with optional filtering, sorting and pagination.\n- The response is concatenated using AND condition (OR is not supported)\n- The maximum result set size is >100\n- Offset is the zero-based number of assessment profiles from the start of the result set\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getStandards", "tags": [ "Standards" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "filters": { "type": "array", "description": "Array of filter conditions", "items": { "$ref": "#/components/schemas/StandardFilter" } }, "sort": { "type": "object", "properties": { "field": { "type": "string", "enum": [ "name", "creation_time", "created_by", "id", "insertion_time" ], "default": "creation_time", "description": "Field to sort by" }, "keyword": { "type": "string", "enum": [ "asc", "desc" ], "default": "asc", "description": "Sort order" } } }, "search_from": { "type": "integer", "minimum": 0, "default": 0, "description": "Zero-based index of the first standard to return. Use with `search_to` to page through results. For example, `search_from: 0` starts at the first standard; `search_from: 50` skips the first 50." }, "search_to": { "type": "integer", "minimum": 1, "default": 100, "description": "Zero-based index marking the end of the page (exclusive). The response includes standards from `search_from` up to, but not including, `search_to`. For example, `search_from: 0` and `search_to: 50` returns the first 50 standards." } } } } }, "examples": { "basic_request": { "$ref": "#/components/examples/get_standards_basic_request" }, "filtered_request": { "$ref": "#/components/examples/get_standards_filtered_request" }, "filter_by_labels": { "$ref": "#/components/examples/filter_by_labels_request" }, "filter_by_time": { "$ref": "#/components/examples/filter_by_time_range_request" } } } } }, "responses": { "200": { "description": "Successfully retrieved standards", "content": { "application/json": { "schema": { "type": "object", "properties": { "total_count": { "type": "integer", "description": "Total number of standards in the system" }, "result_count": { "type": "integer", "description": "Number of standards matching the filter criteria + paging" }, "standards": { "type": "array", "items": { "$ref": "#/components/schemas/Standard" } } } }, "examples": { "success_response": { "$ref": "#/components/examples/get_standards_response" } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/get_standard": { "post": { "summary": "Get single standard by ID (v1)", "description": "Retrieve details of the compliance standard specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getStandard", "tags": [ "Standards" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "Compliance standard ID" } } } } }, "examples": { "get_single_standard": { "$ref": "#/components/examples/get_standard_request" } } } } }, "responses": { "200": { "description": "Successfully retrieved standard", "content": { "application/json": { "schema": { "type": "object", "properties": { "standard": { "$ref": "#/components/schemas/Standard" } } }, "examples": { "single_standard": { "$ref": "#/components/examples/get_standard_response" } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/add_standard": { "post": { "summary": "Add new standard (v1)", "description": "Create a new compliance standard.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "addStandard", "tags": [ "Standards" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "standard_name" ], "properties": { "standard_name": { "type": "string", "description": "Name of the compliance standard" }, "description": { "type": "string", "description": "Description of the standard" }, "labels": { "type": "array", "description": "List of labels for categorization", "items": { "type": "string" } }, "controls_ids": { "type": "array", "description": "List of control IDs to associate with this standard. Only custom controls can be included.", "items": { "type": "string" } } } } } }, "examples": { "Add new standard": { "value": { "standard_name": "Standard name", "description": "Standard description....", "labels": [ "aws", "azure", "gcp", "oci" ], "controls_ids": [ "48f2f6a9fde049479e9c8c8eda0be163" ] } } } } } }, "responses": { "200": { "description": "Standard added successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" }, "examples": { "success": { "$ref": "#/components/examples/add_standard_response" } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/edit_standard": { "post": { "summary": "Edit existing standard (v1)", "description": "Edit an existing compliance standard specified by its ID. \n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "editStandard", "tags": [ "Standards" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "Compliance standard ID" }, "standard_name": { "type": "string", "description": "Name of the standard" }, "description": { "type": "string", "description": "Description of the standard" }, "labels": { "type": "array", "description": "List of labels for categorization", "items": { "type": "string" } }, "controls_ids": { "type": "array", "description": "List of control IDs to associate with this standard. Only custom controls can be included.", "items": { "type": "string" } } } } } }, "examples": { "edit_existing_standard": { "$ref": "#/components/examples/edit_standard_request" } } } } }, "responses": { "200": { "description": "Standard updated successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" }, "examples": { "success": { "$ref": "#/components/examples/edit_standard_response" } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/delete_standard": { "post": { "summary": "Delete standard (v1)", "description": "Delete a the compliance standard specified by its ID.\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "deleteStandard", "tags": [ "Standards" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "request_data": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "Compliance standard ID" } } } } }, "examples": { "delete_standard": { "$ref": "#/components/examples/delete_standard_request" } } } } }, "responses": { "200": { "description": "Standard deleted successfully", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" }, "examples": { "success": { "$ref": "#/components/examples/delete_standard_response" } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalServerError" } } }, "parameters": [] }, "/public_api/v1/compliance/get_assets": { "post": { "summary": "Get compliance assets", "description": "Retrieve compliance assets with required assessment profile revision and last evaluation time, with optional filtering, sorting and pagination.\n\n**Filtering Support:**\n- **String fields** (`asset_name`, `rule_name`, `control`): `eq`, `neq`, `contains`, `not_contains`\n- **Status fields** (`asset_type`, `status`, `severity`, `rule_type`): `eq`, `neq`\n- Status valid values: [`FAILED`, `PASSED`, `NOT_ASSESSED`]\n- Severity valid values: [`low`, `medium`, `high`, `critical`]\n\n**Sorting Support:**\n- Available fields: `asset_name`, `asset_type`, `status`, `rule_name`, `control`, `severity`\n- Sort orders: `asc`, `desc`\n- Default: `asset_name` in ascending order\n\n**Pagination:** (max number of elements is 100)\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "operationId": "getComplianceAssets", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GetAssetsRequest" } } } }, "responses": { "200": { "description": "Successfully retrieved compliance assets", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AssetsResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalServerError" } }, "security": [ { "XDRAuth": [], "XDRAuthToken": [] } ], "tags": [ "Compliance Assets" ] } }, "/public_api/v2/compliance/standards": { "get": { "operationId": "papiListStandards", "summary": "List standards (v2)", "description": "Returns a paginated list of compliance standards for the tenant.\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Standards" ], "parameters": [ { "$ref": "#/components/parameters/OffsetParam" }, { "$ref": "#/components/parameters/LimitParam" } ], "responses": { "200": { "description": "Paginated list of standards", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiPaginatedResponse" }, "example": { "total_count": 130, "results": [ { "id": "28f76be2dfc64733b00427998ed890cb", "name": "CIS Amazon Web Services Foundations Benchmark v3.0.0 - Level 2", "description": "The CIS AWS Foundations Benchmark v3.0.0 - Level 2 offers advanced security best practices for AWS environments with heightened security needs.", "version": "", "publisher": "cis", "release_date": "2021-12-02", "created_by": "Palo Alto Networks", "insert_ts": 1772846812000, "modify_ts": 1772846812000, "is_custom": false, "labels": [ "aws" ], "revision": -6578139629506113158 }, { "id": "54dbfe7142364aff9eaa1fc5ff3bf2f1", "name": "NIST Cybersecurity Framework (CSF) v1.1", "description": "Voluntary framework providing guidance for organizations to manage and reduce cybersecurity risk.", "version": "", "publisher": "nist", "release_date": "2018-04-16", "created_by": "Palo Alto Networks", "insert_ts": 1772846812000, "modify_ts": 1772846812000, "is_custom": false, "labels": [ "azure", "gcp", "aws", "oci" ], "revision": -8782959437081990807 }, { "id": "e7a3b1c9d45e4f2a8b6c0d1e2f3a4b5c", "name": "ACSC Essential Eight Maturity Model", "description": "The Australian Cyber Security Centre Essential Eight strategies to mitigate cyber security incidents, prioritised mitigation strategies to help organisations protect themselves.", "version": "2023", "publisher": "acsc", "release_date": "2023-11-01", "created_by": "Palo Alto Networks", "insert_ts": 1772846812000, "modify_ts": 1772846812000, "is_custom": false, "labels": [ "aws", "azure" ], "revision": 3291847562018473901 } ], "next_offset": 50 } } } }, "400": { "$ref": "#/components/responses/BadRequest" } }, "x-internal": true }, "post": { "operationId": "papiCreateStandard", "summary": "Create a standard (v2)", "description": "Creates a new compliance standard (metadata only).\nRequires `platform_compliance_edit` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Standards" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiStandardCreate" }, "example": { "name": "CIS Amazon Web Services Foundations Benchmark v5.0.0 - Level 1", "description": "CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of Amazon Web Services with an emphasis on foundational, testable, and architecture agnostic settings.", "labels": [ "aws" ] } } }, "description": "Payload for create a standard" }, "responses": { "201": { "description": "Standard created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiStandardResponse" }, "example": { "id": "9c6f7e9c140143a2b29b0f09d034f926", "name": "CIS Amazon Web Services Foundations Benchmark v5.0.0 - Level 1", "description": "CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of Amazon Web Services with an emphasis on foundational, testable, and architecture agnostic settings.", "version": "", "publisher": null, "release_date": "", "created_by": "Palo Alto Networks", "insert_ts": 1750247438000, "modify_ts": 1750247438000, "is_custom": true, "labels": [ "aws" ], "revision": 8450490083431264906 } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "409": { "$ref": "#/components/responses/Conflict" } }, "x-internal": true } }, "/public_api/v2/compliance/standards/{standard_id}": { "parameters": [ { "$ref": "#/components/parameters/StandardIdParam" } ], "get": { "operationId": "papiGetStandard", "summary": "Get a single standard (v2)", "description": "Returns a single compliance standard by ID (metadata only).\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Standards" ], "responses": { "200": { "description": "Standard details", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiStandardResponse" }, "example": { "id": "54dbfe7142364aff9eaa1fc5ff3bf2f1", "name": "NIST Cybersecurity Framework (CSF) v1.1", "description": "Voluntary framework providing guidance for organizations to manage and reduce cybersecurity risk. Version 1.1 enhanced identity management, authentication, and supply chain risk management.", "version": "", "publisher": "nist", "release_date": "2018-04-16", "created_by": "Palo Alto Networks", "insert_ts": 1772846812000, "modify_ts": 1772846812000, "is_custom": false, "labels": [ "azure", "gcp", "aws", "oci" ], "revision": -8782959437081990807 } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true }, "post": { "operationId": "papiUpdateStandard", "summary": "Update a standard (v2)", "description": "Updates an existing compliance standard (metadata only). All fields are optional;\nonly included fields are updated. The `labels` field replaces the entire array when provided.\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the target standard is official (`is_custom: false`).\nOut-of-the-box standards are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Standards" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiStandardUpdate" }, "example": { "name": "NIST Cybersecurity Framework (CSF) v1.1 - Updated", "description": "Voluntary framework providing guidance for organizations to manage and reduce cybersecurity risk. Updated with additional cloud controls.", "labels": [ "azure", "gcp", "aws", "oci", "cloud" ] } } }, "description": "Payload for update a standard" }, "responses": { "200": { "description": "Standard updated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiStandardResponse" }, "example": { "id": "54dbfe7142364aff9eaa1fc5ff3bf2f1", "name": "NIST Cybersecurity Framework (CSF) v1.1 - Updated", "description": "Voluntary framework providing guidance for organizations to manage and reduce cybersecurity risk. Updated with additional cloud controls.", "version": "", "publisher": "nist", "release_date": "2018-04-16", "created_by": "Palo Alto Networks", "insert_ts": 1772846812000, "modify_ts": 1750247500000, "is_custom": false, "labels": [ "azure", "gcp", "aws", "oci", "cloud" ], "revision": 4729183650281947321 } } } }, "400": { "description": "Bad request. In addition to standard validation errors, returns 400 when\nthe target standard is official (`is_custom: false`) — see\n`official_standard` example.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to edit an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot edit standard because it is an official standard", "details": {} } } } } } } }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/Conflict" } }, "x-internal": true }, "delete": { "operationId": "papiDeleteStandard", "summary": "Delete a standard (v2)", "description": "Deletes a compliance standard and cascades to all its categories, subcategories, and controls.\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the target standard is official (`is_custom: false`).\nOut-of-the-box standards are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Standards" ], "responses": { "204": { "description": "Standard deleted (cascades to categories and controls)" }, "400": { "description": "Bad request. Returned when the target standard is official\n(`is_custom: false`).\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to delete an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot delete standard because it is an official standard", "details": {} } } } } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true } }, "/public_api/v2/compliance/standards/{standard_id}/clone": { "parameters": [ { "$ref": "#/components/parameters/StandardIdParam" } ], "post": { "operationId": "papiCloneStandard", "summary": "Clone a standard (v2)", "description": "Creates a deep copy of the source standard with all its categories,\nsubcategories, controls, and control-to-rule associations.\nThe cloned standard gets a new ID, the provided name and description,\nnull version, and release_date set to today. Labels are copied from the source.\nRequires `platform_compliance_edit` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Standards" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CloneStandardRequest" }, "example": { "name": "My Cloned Standard", "description": "A copy of the original standard" } } }, "description": "Payload for clone a standard" }, "responses": { "201": { "description": "Standard cloned successfully with full hierarchy", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CloneStandardResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true } }, "/public_api/v2/compliance/categories": { "get": { "operationId": "papiListCategories", "summary": "List categories (v2)", "description": "Returns categories for a standard. Optionally filter by `parent_category_id` to list only\nsubcategories of a specific parent.\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Categories" ], "parameters": [ { "name": "standard_id", "in": "query", "required": true, "description": "UUID of the standard to list categories for", "schema": { "type": "string", "format": "uuid" } }, { "name": "parent_category_id", "in": "query", "required": false, "description": "Filter by parent category ID. Pass a UUID to list subcategories of that parent.\nOmit to list all categories (top-level and subcategories).\n", "schema": { "type": "string", "format": "uuid", "nullable": true } }, { "$ref": "#/components/parameters/OffsetParam" }, { "$ref": "#/components/parameters/LimitParam" } ], "responses": { "200": { "description": "Paginated list of categories", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiPaginatedResponse" }, "example": { "total_count": 8, "results": [ { "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "parent_category_id": null, "name": "Identity and Access Management", "description": "Controls related to identity management, authentication, and access control in AWS environments.", "created_at": 1750247438, "modified_at": 1750247438, "created_by": "user@example.com", "modified_by": null }, { "id": "d4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f80", "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "parent_category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "name": "Multi-factor Authentication", "description": "Subcategory covering MFA requirements for privileged and standard user accounts.", "created_at": 1750247438, "modified_at": 1750247500, "created_by": "user@example.com", "modified_by": "user@example.com" }, { "id": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e", "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "parent_category_id": null, "name": "Logging and Monitoring", "description": "Controls for ensuring comprehensive logging, monitoring, and alerting across AWS services.", "created_at": 1750247438, "modified_at": 1750247438, "created_by": "user@example.com", "modified_by": null } ], "next_offset": null } } } }, "400": { "$ref": "#/components/responses/BadRequest" } }, "x-internal": true }, "post": { "operationId": "papiCreateCategory", "summary": "Create a category or subcategory (v2)", "description": "Creates a new category within a standard. The `standard_id` must be provided in the\nrequest body. To create a subcategory, set `parent_category_id` to the UUID of an\nexisting top-level category. Max 2 nesting levels (category → subcategory).\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\nReturns **400** if `parent_category_id` references a category belonging to a\ndifferent standard (single-standard-ownership invariant).\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Categories" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiCategoryCreate" }, "examples": { "topLevel": { "summary": "Top-level category (e.g., IAM)", "value": { "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "name": "Identity and Access Management", "description": "Controls related to identity management, authentication, and access control in AWS environments." } }, "subcategory": { "summary": "Subcategory (e.g., MFA under IAM)", "value": { "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "name": "Multi-factor Authentication", "description": "Controls ensuring MFA is enabled for privileged and standard users.", "parent_category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d" } } } } }, "description": "Payload for create a category or subcategory" }, "responses": { "201": { "description": "Category created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiCategoryResponse" }, "example": { "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "parent_category_id": null, "name": "Identity and Access Management", "description": "Controls related to identity management, authentication, and access control in AWS environments.", "created_at": 1750247438, "modified_at": null, "created_by": "user@example.com", "modified_by": null } } } }, "400": { "description": "Bad request. In addition to standard validation errors, returns 400 when:\n- The parent standard is official (`is_custom: false`) — see `official_standard` example.\n- `parent_category_id` references a category belonging to a different standard\n — see `cross_standard_parent` example.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to add a category to an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot add category to standard because it is an official standard", "details": {} } } }, "cross_standard_parent": { "summary": "parent_category_id belongs to a different standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Subcategory parent must belong to the same standard", "details": {} } } } } } } }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/Conflict" }, "422": { "$ref": "#/components/responses/UnprocessableEntity" } }, "x-internal": true } }, "/public_api/v2/compliance/categories/{category_id}": { "parameters": [ { "$ref": "#/components/parameters/CategoryIdParam" } ], "post": { "operationId": "papiUpdateCategory", "summary": "Update a category or subcategory (v2)", "description": "Updates an existing category. Only `name` and `description` can be updated;\n`parent_category_id` is immutable after creation. Any `standard_id` in the\npayload is silently stripped server-side (re-parenting is rejected by the\nsingle-standard-ownership invariant).\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Categories" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiCategoryUpdate" }, "example": { "name": "Identity and Access Management (Revised)", "description": "Updated controls related to identity management, authentication, and access control." } } }, "description": "Payload for update a category or subcategory" }, "responses": { "200": { "description": "Category updated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiCategoryResponse" }, "example": { "id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "parent_category_id": null, "name": "Identity and Access Management (Revised)", "description": "Updated controls related to identity management, authentication, and access control.", "created_at": 1750247438, "modified_at": 1750247500, "created_by": "user@example.com", "modified_by": "user@example.com" } } } }, "400": { "description": "Bad request. In addition to standard validation errors, returns 400 when\nthe parent standard is official (`is_custom: false`) — see\n`official_standard` example.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to modify a category under an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot edit category in standard because it is an official standard", "details": {} } } } } } } }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/Conflict" } }, "x-internal": true }, "delete": { "operationId": "papiDeleteCategory", "summary": "Delete a category (v2)", "description": "Deletes a category and cascades to its subcategories and all associated controls.\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Categories" ], "responses": { "204": { "description": "Category deleted (cascades to subcategories and controls)" }, "400": { "description": "Bad request. Returned when the parent standard is official\n(`is_custom: false`).\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to delete a category from an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot delete category from standard because it is an official standard", "details": {} } } } } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true } }, "/public_api/v2/compliance/controls": { "get": { "operationId": "papiListControls", "summary": "List controls (v2)", "description": "Returns controls for a standard with pagination. Optionally filter by `category_id`.\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Controls" ], "parameters": [ { "name": "standard_id", "in": "query", "required": true, "description": "UUID of the standard to list controls for", "schema": { "type": "string", "format": "uuid" } }, { "name": "category_id", "in": "query", "required": false, "description": "Filter controls by category or subcategory ID", "schema": { "type": "string", "format": "uuid" } }, { "$ref": "#/components/parameters/OffsetParam" }, { "$ref": "#/components/parameters/LimitParam" } ], "responses": { "200": { "description": "Paginated list of controls", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiPaginatedResponse" }, "example": { "total_count": 62, "results": [ { "id": "33d822519cde41aaa7526510efe5d018", "standard_id": "28f76be2dfc64733b00427998ed890cb", "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "name": "Multi-factor authentication - 01", "index": "18", "description": "Multi-factor authentication is used to authenticate users to their organisation's online services that process, store or communicate their organisation's sensitive data.", "mitigation": null, "impact": null, "automation_status": "automated", "audit_procedure": null, "severity": "low", "is_custom": false, "revision": 5444407627480884156, "created_by": "Palo Alto Networks", "modified_by": null, "insert_ts": 1772846817000, "modify_ts": 1772846817000, "rule_ids": [ "rule-mfa-001" ] }, { "id": "ba8ddc45f3aa4a759510642c58a195a3", "standard_id": "28f76be2dfc64733b00427998ed890cb", "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "name": "Multi-factor authentication - 02", "index": "19", "description": "Multi-factor authentication is used to authenticate users to third-party online services that process, store or communicate their organisation's sensitive data.", "mitigation": null, "impact": null, "automation_status": "automated", "audit_procedure": null, "severity": "low", "is_custom": false, "revision": 4962131855986176178, "created_by": "Palo Alto Networks", "modified_by": null, "insert_ts": 1772846817000, "modify_ts": 1772846817000, "rule_ids": [] }, { "id": "c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0", "standard_id": "28f76be2dfc64733b00427998ed890cb", "category_id": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e", "name": "Ensure CloudTrail is enabled in all regions", "index": "3.1", "description": "AWS CloudTrail is a web service that records AWS API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the AWS service.", "mitigation": "Enable CloudTrail in all regions via the AWS Management Console or CLI.", "impact": "Minimal performance impact; storage costs for log files apply.", "automation_status": "automated", "audit_procedure": "Check that a trail exists with multi-region enabled and is logging.", "severity": "critical", "is_custom": false, "revision": 7823456190283746512, "created_by": "Palo Alto Networks", "modified_by": null, "insert_ts": 1772846817000, "modify_ts": 1772846817000, "rule_ids": [ "rule-cloudtrail-001", "rule-cloudtrail-002" ] } ], "next_offset": 50 } } } }, "400": { "$ref": "#/components/responses/BadRequest" } }, "x-internal": true }, "post": { "operationId": "papiCreateControl", "summary": "Create a single control (v2)", "description": "Creates a single control within a standard. The `standard_id` must be provided in the\nrequest body. The control can optionally specify a `category_id` for placement within\nthe hierarchy (use a subcategory ID if placing under a subcategory).\n\nWhen `rule_ids` is provided, the given rules are associated with the newly created control.\n\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiControlCreate" }, "example": { "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "name": "Ensure MFA is enabled for the root account", "index": "1.5", "description": "The root account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device.", "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "automation_status": "automated", "mitigation": "Enable MFA for the root account using a hardware or virtual MFA device.", "rule_ids": [ "rule-aws-iam-mfa-root-001", "rule-aws-iam-mfa-root-002" ] } } }, "description": "Payload for create a single control" }, "responses": { "201": { "description": "Control created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiControlResponse" }, "example": { "id": "deee0446ef984486b1a9ce37e379dd83", "standard_id": "28f76be2dfc64733b00427998ed890cb", "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "name": "Ensure MFA is enabled for the root account", "index": "1.5", "description": "The root account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password.", "mitigation": "Enable MFA for the root account using a hardware or virtual MFA device.", "impact": null, "automation_status": "automated", "audit_procedure": null, "severity": "critical", "is_custom": true, "revision": 8514820482740167575, "created_by": "Palo Alto Networks", "modified_by": null, "insert_ts": 1750247438000, "modify_ts": 1750247438000, "rule_ids": [ "rule-aws-iam-mfa-root-001", "rule-aws-iam-mfa-root-002" ] } } } }, "400": { "description": "Bad request. In addition to standard validation errors, returns 400 when\nthe parent standard is official (`is_custom: false`) — see\n`official_standard` example.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to add a control to an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot add control to standard because it is an official standard", "details": {} } } } } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true } }, "/public_api/v2/compliance/controls/{control_id}": { "parameters": [ { "$ref": "#/components/parameters/ControlIdParam" } ], "get": { "operationId": "papiGetControl", "summary": "Get a single control (v2)", "description": "Returns a single control by ID.\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Controls" ], "responses": { "200": { "description": "Control details", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiControlResponse" }, "example": { "id": "82cc8e75e0084c45b49a94e11670f2e0", "standard_id": "28f76be2dfc64733b00427998ed890cb", "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "name": "Patch applications - 01", "index": "1", "description": "An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.", "mitigation": null, "impact": null, "automation_status": "automated", "audit_procedure": null, "severity": "informational", "is_custom": false, "revision": 5063558221326806453, "created_by": "Palo Alto Networks", "modified_by": null, "insert_ts": 1772846817000, "modify_ts": 1772846817000, "rule_ids": [ "rule-patch-apps-001" ] } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true }, "post": { "operationId": "papiUpdateControl", "summary": "Update a single control (v2)", "description": "Updates a single control by ID. All fields are optional; only included fields are updated.\nWhen `rule_ids` is provided, replaces the full set of rule associations for this control.\nOmit `rule_ids` to leave existing associations unchanged.\n\nAny `standard_id` in the payload is silently stripped server-side\n(re-parenting to a different standard is rejected by the\nsingle-standard-ownership invariant). The `is_custom` field is\nserver-derived from the parent standard and cannot be overridden.\n\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiControlUpdate" }, "example": { "name": "Patch applications - 01 (Revised)", "description": "An automated method of asset discovery is used at least weekly to support the detection of assets for subsequent vulnerability scanning activities.", "severity": "low" } } }, "description": "Payload for update a single control" }, "responses": { "200": { "description": "Control updated", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiControlResponse" }, "example": { "id": "82cc8e75e0084c45b49a94e11670f2e0", "standard_id": "28f76be2dfc64733b00427998ed890cb", "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "name": "Patch applications - 01 (Revised)", "index": "1", "description": "An automated method of asset discovery is used at least weekly to support the detection of assets for subsequent vulnerability scanning activities.", "mitigation": null, "impact": null, "automation_status": "automated", "audit_procedure": null, "severity": "low", "is_custom": false, "revision": -2741422330345269435, "created_by": "Palo Alto Networks", "modified_by": "user@example.com", "insert_ts": 1772846817000, "modify_ts": 1750247500000, "rule_ids": [ "rule-patch-apps-001" ] } } } }, "400": { "description": "Bad request. In addition to standard validation errors, returns 400 when\nthe parent standard is official (`is_custom: false`) — see\n`official_standard` example.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to edit a control under an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot edit control in standard because it is an official standard", "details": {} } } } } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true }, "delete": { "operationId": "papiDeleteControl", "summary": "Delete a single control (v2)", "description": "Deletes a single control by ID.\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Controls" ], "responses": { "204": { "description": "Control deleted" }, "400": { "description": "Bad request. Returned when the parent standard is official\n(`is_custom: false`).\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to delete a control from an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot delete control from standard because it is an official standard", "details": {} } } } } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true } }, "/public_api/v2/compliance/controls/bulk": { "post": { "operationId": "papiBulkCreateControls", "summary": "Bulk create controls (v2)", "description": "Creates multiple controls in a single request. Each item in the request body array\nmust include a `standard_id` field.\n\nReturns a `BulkControlResult` with `succeeded` and `failed` arrays indicating the\noutcome for each control.\n\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/PapiControlCreate" }, "minItems": 1 }, "example": [ { "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "name": "Patch applications - 02", "index": "2", "description": "A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.", "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "automation_status": "automated" }, { "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "name": "Patch applications - 03", "index": "3", "description": "A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in internet-facing services.", "category_id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "automation_status": "automated" }, { "standard_id": "28f76be2-dfc6-4733-b004-27998ed890cb", "name": "Restrict administrative privileges - 01", "index": "4", "description": "Requests for privileged access to systems, applications and data repositories are validated when first requested.", "category_id": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e", "automation_status": "automated" } ] } }, "description": "Payload for bulk create controls" }, "responses": { "200": { "description": "Bulk create result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BulkControlResult" }, "example": { "succeeded": [ { "id": "deee0446ef984486b1a9ce37e379dd83", "success": true, "error": null }, { "id": "f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6", "success": true, "error": null }, { "id": "a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4", "success": true, "error": null } ], "failed": [] } } } }, "400": { "description": "Bad request. In addition to standard validation errors, returns 400 when\nthe parent standard is official (`is_custom: false`) — see\n`official_standard` example.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to bulk-add controls to an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot add controls to standard because it is an official standard", "details": {} } } } } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true } }, "/public_api/v2/compliance/controls/bulk-update": { "post": { "operationId": "papiBulkUpdateControls", "summary": "Bulk update controls (v2)", "description": "Updates multiple controls in a single request. The request body is a\nJSON array of update objects, each containing a `control_id` and the fields to update.\n\nReturns a `BulkControlResult` with `succeeded` and `failed` arrays indicating the\noutcome for each control.\n\nRequires `platform_compliance_edit` permission.\n\nReturns **400** if the parent standard is official (`is_custom: false`).\nOut-of-the-box standards and their children are immutable from this API.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/BulkUpdateControlItem" }, "minItems": 1 }, "example": [ { "control_id": "82cc8e75-e008-4c45-b49a-94e11670f2e0", "name": "Patch applications - 01 (Revised)", "severity": "medium" }, { "control_id": "33d82251-9cde-41aa-a752-6510efe5d018", "description": "Multi-factor authentication is required for all users accessing sensitive data and administrative interfaces.", "severity": "high" } ] } }, "description": "Payload for bulk update controls" }, "responses": { "200": { "description": "Bulk update result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BulkControlResult" }, "example": { "succeeded": [ { "id": "82cc8e75e0084c45b49a94e11670f2e0", "success": true, "error": null }, { "id": "33d822519cde41aaa7526510efe5d018", "success": true, "error": null } ], "failed": [] } } } }, "400": { "description": "Bad request. In addition to standard validation errors, returns 400 when\nthe parent standard of any control in the batch is official\n(`is_custom: false`) — see `official_standard` example.\n", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "examples": { "official_standard": { "summary": "Attempt to bulk-update controls under an official (OOTB) standard", "value": { "error": { "code": "VALIDATION_ERROR", "message": "Cannot edit controls in standard because it is an official standard", "details": {} } } } } } } } }, "x-internal": true } }, "/public_api/v2/compliance/controls/delete": { "post": { "operationId": "papiBulkDeleteControls", "summary": "Bulk delete controls (v2)", "description": "Deletes multiple controls by ID in a single request. Uses `POST` to avoid unreliable\n`DELETE`-with-body pattern.\n\nRequires `platform_compliance_edit` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Controls" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PapiBulkDeleteControls" }, "example": { "control_ids": [ "82cc8e75-e008-4c45-b49a-94e11670f2e0", "33d82251-9cde-41aa-a752-6510efe5d018" ] } } }, "description": "Payload for bulk delete controls" }, "responses": { "200": { "description": "Bulk delete result", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/BulkControlResult" }, "example": { "succeeded": [ { "id": "82cc8e75e0084c45b49a94e11670f2e0", "success": true, "error": null }, { "id": "33d822519cde41aaa7526510efe5d018", "success": true, "error": null } ], "failed": [] } } } }, "400": { "$ref": "#/components/responses/BadRequest" } }, "x-internal": true } }, "/public_api/v2/compliance/standards/import": { "post": { "operationId": "papiImportStandards", "summary": "Upload ZIP file and start async import (v2)", "description": "**Not yet implemented.**\n\nUploads a ZIP file containing one or more standards in the normalized subfolder format\nand starts an asynchronous import job.\n\n**Limits:** Max ZIP size 50 MB.\n\nRequires `platform_compliance_edit` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Import" ], "requestBody": { "required": true, "content": { "multipart/form-data": { "schema": { "type": "object", "required": [ "file" ], "properties": { "file": { "type": "string", "format": "binary", "description": "ZIP file containing standards in normalized subfolder format (max 50 MB)" } } } } }, "description": "Payload for upload zip file and start async import" }, "responses": { "202": { "description": "Import job accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImportJobResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" } }, "x-internal": true } }, "/public_api/v2/compliance/standards/import/{job_id}": { "parameters": [ { "$ref": "#/components/parameters/JobIdParam" } ], "get": { "operationId": "papiGetImportStatus", "summary": "Poll import job status (v2)", "description": "**Not yet implemented.**\n\nReturns the current status of an import job.\n\nStatus values: `pending`, `processing`, `completed`, `failed`.\n\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Import" ], "responses": { "200": { "description": "Import job status", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImportStatusResponse" } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true } }, "/public_api/v2/compliance/standards/export": { "post": { "operationId": "papiExportStandards", "summary": "Start async export job (v2)", "description": "**Not yet implemented.**\n\nStarts an asynchronous export job that generates a ZIP file.\n\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Export" ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportRequest" } } }, "description": "Payload for start async export job" }, "responses": { "202": { "description": "Export job accepted", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportJobResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" } }, "x-internal": true } }, "/public_api/v2/compliance/standards/export/{job_id}": { "parameters": [ { "$ref": "#/components/parameters/JobIdParam" } ], "get": { "operationId": "papiGetExportStatus", "summary": "Poll export job status (v2)", "description": "**Not yet implemented.**\n\nReturns the current status of an export job.\n\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Export" ], "responses": { "200": { "description": "Export job status", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExportStatusResponse" } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true } }, "/public_api/v2/compliance/standards/export/{job_id}/download": { "parameters": [ { "$ref": "#/components/parameters/JobIdParam" } ], "get": { "operationId": "papiDownloadExport", "summary": "Download exported ZIP file (v2)", "description": "**Not yet implemented.**\n\nDownloads the ZIP file generated by a completed export job.\n\nRequires `platform_compliance_view` permission.\n\n\n**Required license:** Cortex Cloud Runtime Security or Cortex Cloud Posture Management.", "tags": [ "Export" ], "responses": { "200": { "description": "ZIP file download", "headers": { "Content-Disposition": { "schema": { "type": "string" }, "description": "Attachment filename" } }, "content": { "application/zip": { "schema": { "type": "string", "format": "binary" } } } }, "404": { "$ref": "#/components/responses/NotFound" } }, "x-internal": true } } }, "components": { "schemas": { "PapiPaginatedResponse": { "type": "object", "description": "PAPI pagination envelope", "required": [ "total_count", "results" ], "properties": { "total_count": { "type": "integer", "description": "Total number of items matching the query", "example": 42 }, "results": { "type": "array", "items": { "type": "object" }, "description": "Array of result items for the current page" }, "next_offset": { "type": "integer", "nullable": true, "description": "Offset for the next page, or null if no more results", "example": 50 } } }, "CloneStandardRequest": { "type": "object", "description": "Request body for cloning a compliance standard.", "required": [ "name" ], "properties": { "name": { "type": "string", "description": "Name for the cloned standard (required).", "example": "My Cloned Standard" }, "description": { "type": "string", "nullable": true, "description": "Description for the cloned standard. If empty or omitted, the cloned standard's description will be empty.", "example": "A copy of the original standard" } } }, "CloneStandardControlResponse": { "type": "object", "description": "Control representation in the clone standard response.", "properties": { "id": { "type": "string", "description": "New control UUID." }, "name": { "type": "string" }, "index": { "type": "string" }, "description": { "type": "string" }, "severity": { "type": "string", "nullable": true }, "category_id": { "type": "string", "nullable": true }, "rule_ids": { "type": "array", "items": { "type": "string" }, "description": "Rule IDs associated with this control." } } }, "CloneStandardSubcategoryResponse": { "type": "object", "description": "Subcategory representation in the clone standard response.", "properties": { "id": { "type": "string", "description": "New subcategory UUID." }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "parent_category_id": { "type": "string", "nullable": true }, "controls": { "type": "array", "items": { "$ref": "#/components/schemas/CloneStandardControlResponse" } } } }, "CloneStandardCategoryResponse": { "type": "object", "description": "Category representation in the clone standard response.", "properties": { "id": { "type": "string", "description": "New category UUID." }, "name": { "type": "string" }, "description": { "type": "string", "nullable": true }, "parent_category_id": { "type": "string", "nullable": true }, "controls": { "type": "array", "items": { "$ref": "#/components/schemas/CloneStandardControlResponse" } }, "subcategories": { "type": "array", "items": { "$ref": "#/components/schemas/CloneStandardSubcategoryResponse" } } } }, "CloneStandardResponse": { "type": "object", "description": "Response model for a cloned compliance standard with full hierarchy.\nReturns the newly created standard with all its deep-copied categories,\nsubcategories, controls, and rule associations.\n", "required": [ "id", "name", "is_custom", "created_by", "insert_ts", "revision" ], "properties": { "id": { "type": "string", "description": "New standard UUID." }, "name": { "type": "string", "description": "Name of the cloned standard." }, "version": { "type": "string", "nullable": true, "description": "Always null for cloned standards." }, "description": { "type": "string", "description": "Description of the cloned standard." }, "publisher": { "type": "string", "nullable": true }, "release_date": { "type": "string", "nullable": true, "description": "Always null for cloned standards." }, "labels": { "type": "array", "items": { "type": "string" }, "description": "Labels copied from the source standard." }, "is_custom": { "type": "boolean", "description": "Always true for cloned standards." }, "revision": { "type": "integer", "format": "int64" }, "created_by": { "type": "string" }, "modified_by": { "type": "string", "nullable": true }, "insert_ts": { "type": "integer", "format": "int64" }, "modify_ts": { "type": "integer", "format": "int64", "nullable": true }, "categories": { "type": "array", "items": { "$ref": "#/components/schemas/CloneStandardCategoryResponse" }, "description": "Full hierarchy of deep-copied categories with subcategories and controls." } } }, "PapiStandardResponse": { "type": "object", "description": "PAPI response model for a compliance standard.\nFields match be3 PAPI v1 `Standard` schema (snake_case naming).\n", "required": [ "id", "name", "is_custom", "created_by", "insert_ts", "revision" ], "properties": { "id": { "type": "string", "description": "Standard unique identifier", "example": "394fc8fc210645f6af8bb4267321482a" }, "name": { "type": "string", "description": "Standard name", "example": "CIS Benchmark v8" }, "description": { "type": "string", "description": "Standard description", "example": "Center for Internet Security Benchmark version 8" }, "version": { "type": "string", "description": "Standard version string", "example": "" }, "publisher": { "type": "string", "nullable": true, "description": "Standard publisher/organization", "example": null }, "release_date": { "type": "string", "description": "Release date", "example": "2025-06-18" }, "created_by": { "type": "string", "description": "User who created the standard", "example": "Palo Alto Networks" }, "insert_ts": { "type": "integer", "format": "int64", "description": "Creation timestamp (epoch milliseconds)", "example": 1750247438000 }, "modify_ts": { "type": "integer", "format": "int64", "nullable": true, "description": "Last modification timestamp (epoch milliseconds)", "example": 1750247439000 }, "is_custom": { "type": "boolean", "description": "Whether this is a custom standard", "example": false }, "labels": { "type": "array", "items": { "type": "string" }, "description": "List of labels for categorization", "example": [ "aws", "azure", "gcp" ] }, "revision": { "type": "integer", "format": "int64", "description": "Content-addressable revision hash (signed 64-bit integer)", "example": -6043636965775741092 } } }, "PapiStandardCreate": { "type": "object", "description": "PAPI request body for creating a standard.", "required": [ "name" ], "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Standard name (unique per tenant)" }, "version": { "type": "string", "default": "1.0", "description": "Standard version string" }, "description": { "type": "string", "maxLength": 2048, "default": "", "description": "Standard description" }, "publisher": { "type": "string", "nullable": true, "description": "Standard publisher/organization" }, "release_date": { "type": "string", "default": "", "description": "Release date string" }, "labels": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 64 }, "maxItems": 20, "description": "Optional labels (max 20 items, each max 64 chars)" } } }, "PapiStandardUpdate": { "type": "object", "description": "PAPI request body for updating a standard. All fields are optional;\nonly included fields are updated.\n", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Updated name (must remain unique per tenant)" }, "version": { "type": "string", "description": "Updated version string" }, "description": { "type": "string", "maxLength": 2048, "description": "Updated description" }, "publisher": { "type": "string", "nullable": true, "description": "Updated publisher/organization" }, "labels": { "type": "array", "items": { "type": "string", "minLength": 1, "maxLength": 64 }, "maxItems": 20, "description": "Replaces the entire labels array" } } }, "PapiCategoryResponse": { "type": "object", "description": "PAPI response model for a compliance category.", "required": [ "id", "standard_id", "name", "created_at", "created_by" ], "properties": { "id": { "type": "string", "format": "uuid", "description": "System-generated UUID v4", "example": "660e8400-e29b-41d4-a716-446655440001" }, "standard_id": { "type": "string", "format": "uuid", "description": "UUID of the parent standard", "example": "550e8400-e29b-41d4-a716-446655440000" }, "parent_category_id": { "type": "string", "format": "uuid", "nullable": true, "description": "UUID of the parent category (null for top-level categories)", "example": null }, "name": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Category name", "example": "Access Control" }, "description": { "type": "string", "maxLength": 2048, "nullable": true, "description": "Optional description", "example": "Controls related to access management" }, "created_at": { "type": "integer", "description": "Creation timestamp (epoch seconds)", "example": 1711000000 }, "modified_at": { "type": "integer", "nullable": true, "description": "Last modification timestamp (epoch seconds)", "example": 1711000000 }, "created_by": { "type": "string", "description": "User who created the resource", "example": "user@example.com" }, "modified_by": { "type": "string", "nullable": true, "description": "User who last modified the resource", "example": "user@example.com" } } }, "PapiCategoryCreate": { "type": "object", "description": "PAPI request body for creating a category.", "required": [ "standard_id", "name" ], "properties": { "standard_id": { "type": "string", "format": "uuid", "description": "UUID of the parent standard" }, "name": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Category name" }, "description": { "type": "string", "maxLength": 2048, "nullable": true, "description": "Optional description" }, "parent_category_id": { "type": "string", "format": "uuid", "nullable": true, "description": "Set to a top-level category UUID to create a subcategory.\nSet to `null` or omit to create a top-level category.\n" } } }, "PapiCategoryUpdate": { "type": "object", "description": "PAPI request body for updating a category. Only `name` and `description`\ncan be updated; `parent_category_id` is immutable.\n", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Updated category name" }, "description": { "type": "string", "maxLength": 2048, "nullable": true, "description": "Updated description" } } }, "PapiControlResponse": { "type": "object", "description": "PAPI response model for a compliance control.\nMatches `PapiControlResponse` Pydantic model (snake_case v2 naming).\n", "required": [ "id", "standard_id", "name", "index", "description", "is_custom", "revision", "created_by", "insert_ts" ], "properties": { "id": { "type": "string", "description": "Control unique identifier", "example": "deee0446ef984486b1a9ce37e379dd83" }, "standard_id": { "type": "string", "description": "UUID of the parent standard this control belongs to", "example": "394fc8fc210645f6af8bb4267321482a" }, "category_id": { "type": "string", "nullable": true, "description": "UUID of the category or subcategory this control belongs to (null if uncategorized)", "example": "660e8400-e29b-41d4-a716-446655440001" }, "name": { "type": "string", "description": "Control name", "example": "Ensure MFA is enabled" }, "index": { "type": "string", "description": "Control index/number within the standard", "example": "1.1" }, "description": { "type": "string", "description": "Control description", "example": "Multi-factor authentication must be enabled for all users" }, "mitigation": { "type": "string", "nullable": true, "description": "Mitigation guidance", "example": null }, "impact": { "type": "string", "nullable": true, "description": "Impact description", "example": null }, "automation_status": { "type": "string", "nullable": true, "description": "Automation status", "example": "automated" }, "audit_procedure": { "type": "string", "nullable": true, "description": "Audit procedure", "example": null }, "severity": { "type": "string", "nullable": true, "description": "Control severity level", "example": "high" }, "is_custom": { "type": "boolean", "description": "Whether this is a custom (user-created) control", "example": true }, "revision": { "type": "integer", "format": "int64", "description": "Content-addressable revision hash (signed 64-bit integer)", "example": 8514820482740167575 }, "created_by": { "type": "string", "description": "User who created the control", "example": "Palo Alto Networks" }, "modified_by": { "type": "string", "nullable": true, "description": "User who last modified the control", "example": null }, "insert_ts": { "type": "integer", "format": "int64", "description": "Creation timestamp (epoch milliseconds)", "example": 1746966658000 }, "modify_ts": { "type": "integer", "format": "int64", "nullable": true, "description": "Last modification timestamp (epoch milliseconds)", "example": 1746966658000 }, "rule_ids": { "type": "array", "items": { "type": "string" }, "description": "List of rule IDs associated with this control", "example": [ "rule-aws-iam-mfa-root-001", "rule-aws-iam-mfa-root-002" ] } } }, "PapiControlCreate": { "type": "object", "description": "PAPI request body for creating a single control.\nMatches `PapiCreateControlRequest` Pydantic model.\n", "required": [ "standard_id", "name", "category_id" ], "properties": { "standard_id": { "type": "string", "format": "uuid", "description": "UUID of the parent standard" }, "name": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Control name" }, "index": { "type": "string", "default": "", "description": "Control index/number within the standard (e.g., \"1.1\", \"4.2\")" }, "description": { "type": "string", "maxLength": 2048, "default": "", "description": "Control description" }, "category_id": { "type": "string", "format": "uuid", "description": "UUID of the parent category or subcategory (required)" }, "mitigation": { "type": "string", "nullable": true, "description": "Mitigation guidance" }, "impact": { "type": "string", "nullable": true, "description": "Impact description" }, "automation_status": { "type": "string", "nullable": true, "description": "Automation status (e.g., \"automated\", \"manual\")" }, "audit_procedure": { "type": "string", "nullable": true, "description": "Audit procedure" }, "rule_ids": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Optional list of rule IDs to associate with this control" } } }, "PapiControlUpdate": { "type": "object", "description": "PAPI request body for updating a single control.\nMatches `PapiUpdateControlRequest` Pydantic model.\nAll fields are optional; only included fields are updated.\n", "properties": { "name": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Updated control name" }, "description": { "type": "string", "maxLength": 2048, "description": "Updated description" }, "category_id": { "type": "string", "format": "uuid", "nullable": true, "description": "Updated category or subcategory ID" }, "mitigation": { "type": "string", "nullable": true, "description": "Updated mitigation guidance" }, "impact": { "type": "string", "nullable": true, "description": "Updated impact description" }, "automation_status": { "type": "string", "nullable": true, "description": "Updated automation status" }, "audit_procedure": { "type": "string", "nullable": true, "description": "Updated audit procedure" }, "severity": { "type": "string", "nullable": true, "description": "Updated severity level" }, "rule_ids": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Optional list of rule IDs to associate with this control (replaces existing associations)" } } }, "PapiBulkDeleteControls": { "type": "object", "description": "PAPI request body for bulk deleting controls.", "required": [ "control_ids" ], "properties": { "control_ids": { "type": "array", "items": { "type": "string" }, "description": "Array of control IDs to delete" } } }, "BulkControlResultItem": { "type": "object", "description": "Result for a single item in a bulk control operation.", "required": [ "id", "success" ], "properties": { "id": { "type": "string", "description": "Control ID", "example": "880e8400-e29b-41d4-a716-446655440001" }, "success": { "type": "boolean", "description": "Whether the operation succeeded for this control", "example": true }, "error": { "type": "string", "nullable": true, "description": "Error message if the operation failed for this control", "example": null } } }, "BulkControlResult": { "type": "object", "description": "Aggregated result of a bulk control operation (create, update, or delete).\nContains two arrays: `succeeded` lists controls that were processed successfully,\nand `failed` lists controls that encountered errors.\n", "required": [ "succeeded", "failed" ], "properties": { "succeeded": { "type": "array", "items": { "$ref": "#/components/schemas/BulkControlResultItem" }, "description": "Controls that were successfully processed" }, "failed": { "type": "array", "items": { "$ref": "#/components/schemas/BulkControlResultItem" }, "description": "Controls that failed processing (each includes an `error` message)" } } }, "BulkUpdateControlItem": { "type": "object", "description": "Single item in a bulk update controls request. Must include `control_id` to identify\nthe control to update. All other fields are optional; only included fields are updated.\n", "required": [ "control_id" ], "properties": { "control_id": { "type": "string", "description": "UUID of the control to update", "example": "880e8400-e29b-41d4-a716-446655440001" }, "name": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Updated control name" }, "description": { "type": "string", "maxLength": 2048, "description": "Updated description" }, "category_id": { "type": "string", "format": "uuid", "nullable": true, "description": "Updated category or subcategory ID" }, "mitigation": { "type": "string", "nullable": true, "description": "Updated mitigation guidance" }, "impact": { "type": "string", "nullable": true, "description": "Updated impact description" }, "automation_status": { "type": "string", "nullable": true, "description": "Updated automation status" }, "audit_procedure": { "type": "string", "nullable": true, "description": "Updated audit procedure" }, "severity": { "type": "string", "nullable": true, "description": "Updated severity level" }, "rule_ids": { "type": "array", "items": { "type": "string" }, "nullable": true, "description": "Optional list of rule IDs to associate with this control (replaces existing associations)" } } }, "ErrorResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "err_code": { "type": "integer", "description": "Error code" }, "err_msg": { "type": "string", "description": "Error message describing what went wrong" }, "err_extra": { "type": "object", "description": "Additional error details" } }, "required": [ "err_code", "err_msg" ] } } }, "ImportJobResponse": { "type": "object", "required": [ "job_id", "status", "created_at" ], "properties": { "job_id": { "type": "string", "format": "uuid" }, "status": { "type": "string", "enum": [ "pending" ] }, "created_at": { "type": "string", "format": "date-time" } } }, "ImportStandardResult": { "type": "object", "required": [ "folder", "standard_name", "status" ], "properties": { "folder": { "type": "string" }, "standard_name": { "type": "string" }, "status": { "type": "string", "enum": [ "success", "failed" ] }, "standard_id": { "type": "string", "format": "uuid" }, "categories_created": { "type": "integer" }, "controls_created": { "type": "integer" }, "error": { "type": "object", "properties": { "code": { "type": "string" }, "message": { "type": "string" } } } } }, "ImportStatusResponse": { "type": "object", "required": [ "job_id", "status", "created_at" ], "properties": { "job_id": { "type": "string", "format": "uuid" }, "status": { "type": "string", "enum": [ "pending", "processing", "completed", "failed" ] }, "created_at": { "type": "string", "format": "date-time" }, "completed_at": { "type": "string", "format": "date-time", "nullable": true }, "total_standards": { "type": "integer" }, "processed_standards": { "type": "integer" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/ImportStandardResult" } } } }, "ExportRequest": { "type": "object", "properties": { "standard_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } } } }, "ExportJobResponse": { "type": "object", "required": [ "job_id", "status", "created_at" ], "properties": { "job_id": { "type": "string", "format": "uuid" }, "status": { "type": "string", "enum": [ "pending" ] }, "created_at": { "type": "string", "format": "date-time" } } }, "ExportStatusResponse": { "type": "object", "required": [ "job_id", "status", "created_at" ], "properties": { "job_id": { "type": "string", "format": "uuid" }, "status": { "type": "string", "enum": [ "pending", "processing", "completed", "failed" ] }, "created_at": { "type": "string", "format": "date-time" }, "completed_at": { "type": "string", "format": "date-time", "nullable": true }, "total_standards": { "type": "integer" }, "processed_standards": { "type": "integer" }, "download_url": { "type": "string", "nullable": true } } }, "GetAssessmentProfilesRequest": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "properties": { "filters": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentProfileFilter" } }, "sort": { "$ref": "#/components/schemas/AssessmentProfileSortObject" }, "search_from": { "type": "integer", "minimum": 0, "default": 0, "description": "Zero-based index of the first assessment profile to return. Use with `search_to` to page through results. For example, `search_from: 0` starts at the first assessment profile; `search_from: 50` skips the first 50." }, "search_to": { "type": "integer", "minimum": 1, "default": 100, "description": "Zero-based index marking the end of the page (exclusive). The response includes assessment profiles from `search_from` up to, but not including, `search_to`. For example, `search_from: 0` and `search_to: 50` returns the first 50 assessment profiles." } } } } }, "EditAssessmentProfileRequest": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "id" ], "properties": { "id": { "type": "string", "description": "Assessment profile ID" }, "enabled": { "oneOf": [ { "type": "string", "enum": [ "yes", "no" ], "description": "Whether the assessment profile is enabled. Valid values are:\n- `yes`\n- `no`" }, { "type": "boolean", "description": "Whether the assessment profile is enabled" } ], "description": "Enable or disable the assessment profile" }, "profile_name": { "type": "string", "description": "Name of the assessment profile" }, "description": { "type": "string", "description": "Description of the assessment profile" }, "report_targets": { "type": "array", "description": "List of email addresses for reports", "items": { "type": "string", "format": "email" } }, "report_type": { "type": "string", "enum": [ "ALL", "PDF", "CSV", "NONE" ], "description": "Type of reporting. Valid values include:\n- `ALL`\n- `PDF`\n- `CSV`\n- `NONE`" }, "evaluation_frequency": { "type": "string", "description": "Cron expression for assessment report evaluation frequency", "format": "cron", "example": "0 12 * * *" }, "asset_group_id": { "type": "integer", "description": "Asset group ID" }, "standard_id": { "type": "string", "description": "Compliance standard ID" } } } }, "x-examples": { "Example 1": { "request_data": { "id": "48e2f6a9fdc049479e9c6a8eda0bd163", "control_name": "Control 1" } } } }, "AssessmentProfileFilter": { "type": "object", "x-examples": { "Example 1": { "field": "creation_time", "operator": "gte", "value": 0 } }, "properties": { "field": { "type": "string", "description": "Identifies the assessment profile field the filter should match. Filters are based on the following keywords:\n- `name`: Assessment profile name\n- `standard_name` : Standard name\n- `description`: Assessment profile description\n- `asset_group_name`: Asset Group name\n- `created_by`: Creator of the assessment profile\n- `modified_by`: Modifier of the assessment profile\n- `id`: Assessment profile ID\n- `report_type`: Report type\n- `standard_id`: Standard ID\n- `creation_time`: Assessment profile's creation time\n- `modification_time`: Assessment profile's modification time\n- `enabled`: Whether the assessment profile is enabled\n- `asset_group_id`: Asset Group ID" }, "operator": { "type": "string", "description": "Identifies the comparison operator you want to use for this filter. Valid keywords are:\n\n`eq` / `neq` / `contains` / `not_contains`\n\n- `name`, `standard_name`, `description`, `asset_group_name`, `created_by`, `modified_by`, `id`, `report_type`, `standard_id`: String\n\n`gte`, `lte`, `range`, `relative_timestamp`\n- `creation_time`, `modification_time`: Integer in timestamp epoch milliseconds\n\n`in`\n- `enabled`: valid values are `yes` or `no`\n\n`eq` / `neq`\n- `asset_group_id`: String" }, "value": { "oneOf": [ { "type": "string", "description": "When the `field` value is one of the following, the `value` is type string: `name`, `standard_name`, `description`, `asset_group_name`, `created_by`, `modified_by`, `id`, `report_type`, `standard_id`, `asset_group_id`" }, { "type": "integer", "description": "When the `field` value is one of the following, the `value` is type integer: `creation_time`, `modification_time`" }, { "enum": [ "yes", "no" ], "description": "When the `field` value is one of the following, the `value` is type enum: `enabled`" } ], "description": "Value that this filter must match. The contents of this field will differ depending on the assessment profile `field` that you specified for this filter" } } }, "AssessmentProfileSortObject": { "type": "object", "properties": { "field": { "type": "string", "enum": [ "name", "category", "subcategory", "creation_time", "created_by", "modified_by", "modified_ts", "id", "description", "standard_name", "standard_id", "enabled", "asset_group_name", "modification_time", "report_type" ], "default": "creation_time", "description": "Sort according to this field" }, "keyword": { "type": "string", "enum": [ "asc", "desc" ], "default": "asc", "description": "Sort in ascending (`asc`) or descending (`desc`) order" } } }, "AssetSortObject": { "type": "object", "properties": { "field": { "type": "string", "enum": [ "asset_name", "asset_type", "status", "rule_name", "control", "severity" ], "description": "Field to sort by", "default": "asset_name", "example": "asset_name" }, "keyword": { "type": "string", "enum": [ "asc", "desc" ], "default": "asc", "description": "Sort direction", "example": "asc" } } }, "AssessmentProfile": { "type": "object", "x-examples": { "Example 1": { "ID": "472141782aff4a2f999c5e3c35745b3a", "NAME": "Assessment example", "STANDARD_ID": "2nnd684-4z14-5cs82-c1a0-7c322b671844", "STANDARD_NAME": "CIS Amazon Linux 2 Benchmark v1.0.0", "ASSET_GROUP_ID": 1, "ASSET_GROUP_NAME": "asset group name", "DESCRIPTION": "assessment description", "REPORT_FREQUENCY": null, "REPORT_TARGETS": [], "REPORT_TYPE": "NONE", "ENABLED": true, "INSERT_TS": 1748259453615, "MODIFY_TS": 1748259453615, "CREATED_BY": "Generic Name", "MODIFIED_BY": "Generic Name" } }, "properties": { "id": { "type": "string", "description": "Assessment profile ID" }, "name": { "type": "string", "description": "Assessment profile name" }, "description": { "type": "string", "description": "Description of the assessment profile" }, "enabled": { "type": "boolean", "description": "Whether the assessment profile is enabled" }, "standard_id": { "type": "string", "description": "Standard ID" }, "standard_name": { "type": "string", "description": "Standard name" }, "asset_group_id": { "type": "integer", "description": "Asset Group ID" }, "asset_group_name": { "type": "string", "description": "Asset Group name" }, "report_type": { "type": "string", "description": "Report type" }, "report_targets": { "type": "array", "items": { "type": "string", "format": "email" } }, "evaluation_frequency": { "type": "string" }, "creation_time": { "type": "string", "format": "date-time", "description": "Assessment profile creation time" }, "modification_time": { "type": "string", "format": "date-time", "description": "Assessment profile modification time" }, "created_by": { "type": "string", "description": "Assessment profile creator" }, "modified_by": { "type": "string", "description": "Assessment profile modified by" } } }, "AssessmentProfilesResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "total_count": { "type": "integer", "description": "Total number of records" }, "result_count": { "type": "integer", "description": "Number of records matching the filter + paging" }, "assessment_profiles": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentProfile" } } } } }, "example": { "reply": { "total_count": 925, "result_count": 1, "assessment_profiles": [ { "ID": "472141782aff4a2f999c5e3c35745b3a", "NAME": "Assessment example", "STANDARD_ID": "2nnd684-4z14-5cs82-c1a0-7c322b671844", "STANDARD_NAME": "CIS Amazon Linux 2 Benchmark v1.0.0", "ASSET_GROUP_ID": 1, "ASSET_GROUP_NAME": "asset group name", "DESCRIPTION": "assessment description", "REPORT_FREQUENCY": null, "REPORT_TARGETS": [], "REPORT_TYPE": "NONE", "ENABLED": true, "INSERT_TS": 1748259453615, "MODIFY_TS": 1748259453615, "CREATED_BY": "Generic Name", "MODIFIED_BY": "Generic Name" } ] } } }, "AssessmentProfileResponse": { "$ref": "#/components/schemas/AssessmentProfile", "x-examples": { "Example 1": { "ID": "472141782aff4a2f999c5e3c35745b3a", "NAME": "Assessment example", "STANDARD_ID": "2nnd684-4z14-5cs82-c1a0-7c322b671844", "STANDARD_NAME": "CIS Amazon Linux 2 Benchmark v1.0.0", "ASSET_GROUP_ID": 1, "ASSET_GROUP_NAME": "asset group name", "DESCRIPTION": "assessment description", "REPORT_FREQUENCY": null, "REPORT_TARGETS": [], "REPORT_TYPE": "NONE", "ENABLED": true, "INSERT_TS": 1748259453615, "MODIFY_TS": 1748259453615, "CREATED_BY": "Generic Name", "MODIFIED_BY": "Generic Name" } } }, "GetAssessmentResultsRequest": { "type": "object", "properties": { "request_data": { "type": "object", "properties": { "filters": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentResultFilterObject" }, "description": "Array of filter objects" } } } }, "required": [ "request_data" ], "example": { "request_data": { "filters": [ { "field": "labels", "operator": "contains", "value": "aws" } ] } } }, "AssessmentResultsResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "total_count": { "type": "integer", "description": "Total number of assessment results available", "example": 150 }, "result_count": { "type": "integer", "description": "Number of assessment results matching the applied filters", "example": 25 }, "standard_filter_count": { "type": "integer", "description": "Count from standard filter processing", "example": 25 }, "standard_total_count": { "type": "integer", "description": "Total count from standard processing", "example": 150 }, "data": { "type": "array", "items": { "$ref": "#/components/schemas/AssessmentResult" }, "description": "Array of assessment profile results" } } } } }, "AssessmentResult": { "type": "object", "description": "Individual assessment profile result data", "example": { "TYPE": "standard", "SCORE": null, "ASSET_GROUP_NAME": null, "ASSET_GROUP_ID": null, "ADDITIONAL_DATA": null, "LAST_EVALUATION_TIME": 1751533328000, "STANDARD_NAME": "CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.4", "PROFILES_COUNT": 3, "STANDARD_ID": 9101546381587280000, "LABELS": [ "eks" ], "PATH": [ "CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.4" ], "FAILED_CONTROLS_SEVERITY": [ { "value": "CRITICAL", "count": 0, "pretty_name": "Critical" }, { "value": "HIGH", "count": 0, "pretty_name": "High" }, { "value": "MEDIUM", "count": 1, "pretty_name": "Medium" }, { "value": "LOW", "count": 2, "pretty_name": "Low" }, { "value": "INFORMATIONAL", "count": 0, "pretty_name": "Informational" } ], "CONTROLS_STATUS": [ { "value": "PASSED", "count": 0, "pretty_name": "Passed" }, { "value": "NOT_ASSESSED", "count": 153, "pretty_name": "Not Assessed" }, { "value": "FAILED", "count": 0, "pretty_name": "Failed" } ], "ASSESSMENT_PROFILE_REVISION": null } }, "GetAssetsRequest": { "type": "object", "required": [ "request_data" ], "properties": { "request_data": { "type": "object", "required": [ "assessment_profile_revision", "last_evaluation_time" ], "properties": { "assessment_profile_revision": { "type": "string", "description": "Assessment profile revision identifier", "example": "343554605578776831" }, "last_evaluation_time": { "type": "integer", "format": "int64", "description": "Last evaluation timestamp in epoch format", "example": 1758816221000 }, "filters": { "type": "array", "description": "Array of filter objects for filtering assets", "items": { "$ref": "#/components/schemas/AssetFilterObject" } }, "sort": { "$ref": "#/components/schemas/AssetSortObject" }, "search_from": { "type": "integer", "minimum": 0, "default": 0, "description": "Starting index for pagination" }, "search_to": { "type": "integer", "minimum": 1, "default": 100, "description": "Ending index for pagination" } } } } }, "AssetsResponse": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "total_count": { "type": "integer", "description": "Total number of assets available", "example": 134 }, "result_count": { "type": "integer", "description": "Number of assets matching the applied filters + paging", "example": 29 }, "filter_count": { "type": "integer", "description": "Number of assets matching the applied filters", "example": 29 }, "assets": { "type": "array", "description": "Array of compliance assets", "items": { "$ref": "#/components/schemas/ComplianceAsset" } } } } } }, "ComplianceAsset": { "type": "object", "description": "Compliance asset information", "properties": { "ASSET_ID": { "type": "string", "description": "Identifier for the asset", "example": "a4d9b7b4e7c88cecaf24a063d86cb0069ed659f8bc66c4c1572c90e716291e3d" }, "ASSET_NAME": { "type": "string", "description": "Name of the asset", "example": "mock-gcloud-storage-buckets-list-3d0a69ff21184406aa1cbd07b29f6f1f" }, "ASSET_TYPE": { "type": "string", "description": "Type of the asset", "example": "GOOGLE_CLOUD_STORAGE_BUCKET" }, "STATUS": { "type": "string", "enum": [ "FAILED", "PASSED", "NOT_ASSESSED" ], "description": "Compliance status of the asset", "example": "PASSED" }, "RULE_NAME": { "type": "string", "description": "Name of the compliance rule", "example": "Sensitive public object in private storage" }, "CONTROL": { "type": "string", "description": "Associated compliance control", "example": "Safeguard 3.2 : Establish and Maintain a Data Inventory" }, "RULE_REVISION_ID": { "type": "string", "description": "Identifier for the compliance rule", "example": "DSPM_1006" }, "CONTROL_REVISION_ID": { "type": "integer", "format": "int64", "description": "Identifier for the associated compliance control", "example": -7177800670050593000 }, "SOURCE": { "type": "string", "description": "Asset source", "example": "No Finding or Issue" }, "SEVERITY": { "type": "string", "enum": [ "low", "medium", "high", "critical" ], "description": "Severity level of the compliance issue", "example": "high" }, "RULE_TYPE": { "type": "string", "description": "Type of the compliance rule", "example": "Data" }, "PROVIDER": { "type": "string", "description": "Cloud provider", "example": "GCP" }, "REGION": { "type": "string", "description": "Geographic region", "example": "us" }, "REALM": { "type": "string", "description": "Realm identifier", "example": "gcp-c0844a50-dd0f-47ec-9d14-c7af5f5325aa" }, "TAGS": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Asset tags", "example": { "Name": "mock-gcloud-storage-buckets-list-3d0a69ff21184406aa1cbd07b29f6f1f" } }, "ORGANIZATION": { "type": "string", "nullable": true, "description": "Organization identifier", "example": null }, "ASSET_STRONG_ID": { "type": "string", "description": "Strong identifier for the asset", "example": "mock-gcloud-storage-buckets-list-3d0a69ff21184406aa1cbd07b29f6f1f" } } }, "AssessmentResultFilterObject": { "type": "object", "description": "Filter object for querying assessment results", "required": [ "field", "operator", "value" ], "properties": { "field": { "type": "string", "enum": [ "labels" ], "description": "Field to filter on (only 'labels' is supported)", "example": "labels" }, "operator": { "type": "string", "enum": [ "contains", "not_contains" ], "description": "Filter operator to apply. Valid values include:\n- `contains`\n- `not_contains`", "example": "contains" }, "value": { "type": "string", "description": "Value to filter by", "example": "azure" } } }, "AssetFilterObject": { "type": "object", "description": "Filter object for querying compliance assets", "required": [ "field", "operator", "value" ], "properties": { "field": { "type": "string", "enum": [ "asset_name", "asset_type", "status", "rule_name", "control", "severity", "rule_type", "SEVERITY", "ASSET_NAME", "ASSET_TYPE", "STATUS", "RULE_NAME", "CONTROL", "RULE_TYPE" ], "description": "Field to filter on", "example": "SEVERITY" }, "operator": { "type": "string", "description": "Filter operator to apply", "example": "eq" }, "value": { "type": "string", "description": "Value to filter by", "example": "high" } }, "allOf": [ { "if": { "properties": { "field": { "enum": [ "asset_name", "rule_name", "control", "ASSET_NAME", "RULE_NAME", "CONTROL" ] } } }, "then": { "properties": { "operator": { "enum": [ "eq", "neq", "contains", "not_contains" ] } } } }, { "if": { "properties": { "field": { "enum": [ "asset_type", "status", "severity", "rule_type", "ASSET_TYPE", "STATUS", "SEVERITY", "RULE_TYPE" ] } } }, "then": { "properties": { "operator": { "enum": [ "eq", "neq" ] } } } }, { "if": { "properties": { "field": { "enum": [ "status", "STATUS" ] } } }, "then": { "properties": { "value": { "enum": [ "FAILED", "PASSED", "NOT_ASSESSED" ] } } } }, { "if": { "properties": { "field": { "enum": [ "severity", "SEVERITY" ] } } }, "then": { "properties": { "value": { "enum": [ "low", "medium", "high", "critical" ] } } } } ] }, "Filter": { "type": "object", "required": [ "field", "operator", "value" ], "properties": { "field": { "type": "string", "enum": [ "name", "category", "subcategory", "is_custom", "creation_time", "created_by", "modified_by", "modification_time", "id", "description" ], "description": "Identifies the compliance control field the filter should match. Filters are based on the following keywords:\n- `name`: Compliance control name\n- `category` : Compliance control category\n- `subcategory`: Compliance control subcategory\n- `description`: Compliance control description\n- `created_by`: Creator of the compliance control\n- `modified_by`: Modifier of the compliance control\n- `id`: Compliance control ID\n- `creation_time`: Compliance control's creation time\n- `modification_time`: Compliance control's modification time\n- `is_custom`: Whether the compliance control is custom" }, "operator": { "enum": [ "eq", "neq", "contains", "not_contains", "gte", "lte", "range", "relative_timestamp", "in" ], "description": "Identifies the comparison operator you want to use for this filter. Valid keywords are:\n\n`eq` / `neq` / `contains` / `not_contains`: \n- `name`, `category`, `subcategory`, `created_by`, `modified_by`, `id`, `description`: String\n\n`gte`, `lte`, `range`, `relative_timestamp`: \n- `creation_time`, `modification_time`: Integer in timestamp epoch milliseconds\n\n`in`:\n- `is_custom`: valid values are `yes` or `no`" }, "value": { "oneOf": [ { "type": "string", "description": "When the `field` value is one of the following, the `value` is type string: `name`, `category`, `subcategory`, `created_by`, `modified_by`, `id`, `description`" }, { "type": "integer", "description": "When the `field` value is one of the following, the `value` is type integer: `creation_time`, `modification_time`" }, { "enum": [ "yes", "no" ], "description": "When the `field` value is one of the following, the `value` is type enum: `is_custom`" } ], "description": "Value that this filter must match. The contents of this field will differ depending on the assessment profile `field` that you specified for this filter." } } }, "Control": { "type": "object", "properties": { "id": { "type": "string", "description": "Compliance control ID" }, "name": { "type": "string", "description": "Compliance control name" }, "description": { "type": "string", "description": "Description of the compliance control" }, "category": { "type": "string", "description": "Compliance control category" }, "subcategory": { "type": "string", "description": "Compliance control subcategory" }, "creation_time": { "type": "integer", "format": "int64", "description": "Creation timestamp" }, "modification_time": { "type": "integer", "format": "int64", "description": "Last modification timestamp" }, "created_by": { "type": "string", "description": "User who created the control" }, "modified_by": { "type": "string", "description": "User who last modified the control" }, "is_custom": { "type": "boolean", "description": "Whether this is a custom control" } } }, "ComplianceReport": { "type": "object", "description": "Archived compliance assessment report", "example": { "report_id": 2, "standard_name": "Secure Controls Framework (SCF) v2022.2.1", "assessment_profile": "test-p1", "asset_group": "Asset group for AWS, Azure & GCP", "score": 63, "controls_status": [ { "count": 11, "value": "PASSED", "pretty_name": "Passed" }, { "count": 1027, "value": "NOT_ASSESSED", "pretty_name": "Not assessed" }, { "count": 19, "value": "FAILED", "pretty_name": "Failed" } ], "failed_controls_severity": [ { "count": 1, "value": "CRITICAL", "pretty_name": "Critical" }, { "count": 11, "value": "HIGH", "pretty_name": "High" }, { "count": 5, "value": "MEDIUM", "pretty_name": "Medium" }, { "count": 2, "value": "LOW", "pretty_name": "Low" }, { "count": 0, "value": "INFORMATIONAL", "pretty_name": "Informational" } ], "evaluation_time": 1759305778000, "assessment_profile_id": "ddc31d5742ba4480b6d1c940c51651c2", "cvs_file_deleted": false } }, "ReportFilter": { "examples": { "string_filter": { "summary": "String field filter", "value": { "field": "standard_name", "operator": "eq", "value": "SOC2" } }, "score_filter": { "summary": "Score filter", "value": { "field": "score", "operator": "gte", "value": 85 } }, "time_filter": { "summary": "Time filter", "value": { "field": "evaluation_time", "operator": "gte", "value": 1640995200000 } } }, "type": "object", "required": [ "field", "operator", "value" ], "properties": { "field": { "enum": [ "standard_name", "assessment_profile_name", "asset_group_name", "score", "evaluation_time" ], "description": "Identifies the compliance report field the filter should match. Filters are based on the following keywords:\n- `standard_name`: Standard name\n- `assessment_profile_name`: Assessment profile name\n- `asset_group_name`: Asset Group name\n- `score`: Compliance score\n- `evaluation_time`: Evaluation time" }, "operator": { "enum": [ "eq", "neq", "contains", "not_contains", "gte", "lte", "range", "relative_timestamp" ], "description": "Identifies the comparison operator you want to use for this filter. Valid keywords are:\n\n`eq` / `neq` / `contains` / `not_contains`: \n- `standard_name`, `assessment_profile_name`, `asset_group_name`: String\n\n`gte` / `lte` / `range` / `relative_timestamp`: \n- `evaluation_time``: Integer in timestamp epoch milliseconds\n\n`gte` / `lte` / `eq` / `neq`:\n- `score`: Integer" }, "value": { "oneOf": [ { "type": "string", "description": "When the `field` value is one of the following, the `value` is type string: `standard_name`, `assessment_profile_name`, `asset_group_name`" }, { "type": "integer", "description": "When the `field` value is one of the following, the `value` is type integer: `evaluation_time`, `score`" } ], "description": "Value that this filter must match. The contents of this field will differ depending on the assessment profile `field` that you specified for this filter." } } }, "Rule": { "type": "object", "required": [ "name", "type", "logical_id", "scannable_assets", "generate_findings", "generate_issues", "generate_scan_logs" ], "properties": { "name": { "type": "string", "description": "Rule name" }, "description": { "type": "string", "description": "Description of the rule" }, "type": { "type": "string", "description": "Rule type", "enum": [ "Identity" ] }, "logical_id": { "type": "string", "description": "Logical identifier for the rule" }, "severity": { "type": "string", "description": "Rule severity level", "enum": [ "low", "medium", "high", "critical" ], "default": "low" }, "scannable_assets": { "type": "array", "description": "List of scannable asset types", "example": [ "KUBERNETES_NODE" ], "items": { "type": "string" } }, "remediation_steps": { "type": "string", "description": "Steps to remediate violations" }, "generate_findings": { "type": "boolean", "description": "Whether to generate findings for this rule" }, "generate_issues": { "type": "boolean", "description": "Whether to generate issues for this rule" }, "generate_scan_logs": { "type": "boolean", "description": "Whether to generate scan logs for this rule" } } }, "Error": { "type": "object", "properties": { "reply": { "type": "object", "properties": { "err_code": { "type": "integer", "description": "Error code" }, "err_msg": { "type": "string", "description": "Error message" }, "err_extra": { "type": "object", "description": "Additional error details" } } } } }, "Findings": { "title": "Findings", "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "string" } } }, "x-examples": { "Example 1": { "ids": [ "45667840n85678918765456789bkk" ], "value": 1 } } }, "Issues": { "type": "array", "x-examples": { "Example 1": [ { "name": "SEV_020_LOW", "pretty_name": "Low", "value": 0, "ids": [] }, { "name": "SEV_030_MEDIUM", "pretty_name": "Medium", "value": 0, "ids": [] }, { "name": "SEV_040_HIGH", "pretty_name": "High", "value": 1, "ids": [ "4567893ijnmskiu7y6t5rxt6y789ok" ] }, { "name": "SEV_050_CRITICAL", "pretty_name": "Critical", "value": 0, "ids": [] } ] }, "items": { "type": "object", "properties": { "name": { "type": "string", "description": "Severity name" }, "pretty_name": { "type": "string" }, "value": { "type": "integer", "description": "The number of issues with this level of severity" }, "ids": { "type": "array", "description": "List of issue IDs with this level of severity", "items": { "type": "string" } } } } }, "SuccessResponse": { "type": "object", "properties": { "success": { "type": "boolean", "description": "Operation success status" } } }, "Standard": { "type": "object", "properties": { "id": { "type": "string", "description": "Standard ID" }, "name": { "type": "string", "description": "Standard name" }, "description": { "type": "string", "description": "Description of the standard" }, "publisher": { "type": "string", "description": "Standard publisher/organization" }, "labels": { "type": "array", "description": "List of labels for categorization", "items": { "type": "string", "example": "aws" } }, "insertion_time": { "type": "integer", "format": "int64", "description": "Creation timestamp (epoch)" }, "created_by": { "type": "string", "description": "User who created the standard" }, "is_custom": { "type": "boolean", "description": "Whether this is a custom standard" }, "controls_count": { "type": "integer", "description": "Number of associated controls" }, "controls_ids": { "type": "array", "description": "List of associated control IDs", "items": { "type": "string" } } } }, "StandardFilter": { "type": "object", "required": [ "field", "operator", "value" ], "properties": { "field": { "type": "string", "enum": [ "name", "id", "publisher", "is_custom", "insertion_time", "created_by", "labels" ], "description": "Identifies the compliance standard field the filter should match. Filters are based on the following keywords:\n- `name`: Compliance standard name\n- `id`: Compliance standard ID\n- `publisher`: Compliance standard publisher\n- `created_by`: User who created the compliance standard\n- `insertion_time`: When the compliance standard was created\n- `is_custom`: Whether the compliance standard is custom\n- `labels`: Compliance standard labels" }, "operator": { "enum": [ "eq", "neq", "contains", "not_contains", "gte", "lte", "range", "relative_timestamp", "in" ], "description": "Identifies the comparison operator you want to use for this filter. Valid keywords are:\n\n`eq` / `neq` / `contains` / `not_contains`: \n- `name`, `id`, `publisher`, `created_by`: String\n\n`gte` / `lte` / `range` / `relative_timestamp`: \n- `insertion_time``: Integer in timestamp epoch milliseconds\n\n`in`:\n- `is_custom`: Enum with possible values of `yes` or `no`\n\n`contains` / `not_contains`:\n- `labels`: Array of strings" }, "value": { "oneOf": [ { "type": "string", "description": "When the `field` value is one of the following, the `value` is type string: `name`, `id`, `publisher`, `created_by`" }, { "type": "integer", "description": "When the `field` value is one of the following, the `value` is type integer: `insertion_time`" }, { "enum": [ "yes", "no" ], "description": "When the `field` value is one of the following, the `value` is type enum: `is_custom`" }, { "type": "array", "description": "When the `field` value is one of the following, the `value` is an array of strings: `labels`", "items": { "type": "string" } } ], "description": "Value that this filter must match. The contents of this field will differ depending on the assessment profile `field` that you specified for this filter." } } } }, "responses": { "UnprocessableEntity": { "description": "Semantically invalid request (e.g., parent_category_id references a subcategory)", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "error": { "code": "UNPROCESSABLE_ENTITY", "message": "parent_category_id must reference a top-level category", "details": {} } } } } }, "Unauthorized": { "description": "Authentication required", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "reply": { "err_code": 401, "err_msg": "Authentication credentials were not provided or are invalid", "err_extra": {} } } } } }, "Conflict": { "description": "Conflict - duplicate resource", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "Forbidden": { "description": "Access denied - insufficient permissions", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "example": { "reply": { "err_code": 403, "err_msg": "You do not have permission to access assessment results", "err_extra": {} } } } } }, "ReportsBadRequest": { "description": "Bad request - invalid input parameters for reports", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "examples": { "invalid_score_value": { "summary": "Invalid score value", "value": { "reply": { "err_code": 400, "err_msg": "Invalid score value. Score must be between 0 and 100", "err_extra": {} } } }, "invalid_operator_for_field": { "summary": "Invalid operator for specific field", "value": { "reply": { "err_code": 400, "err_msg": "Invalid operator 'contains' for field 'score'. Allowed operators: gte, lte, eq, neq", "err_extra": {} } } }, "invalid_sort_field": { "summary": "Invalid sort field", "value": { "reply": { "err_code": 400, "err_msg": "Invalid sort field. Allowed fields: standard_name, assessment_profile_name, asset_group_name, score, evaluation_time", "err_extra": {} } } }, "invalid_filter_field": { "summary": "Invalid filter field", "value": { "reply": { "err_code": 400, "err_msg": "Invalid filter field 'invalid_field'. Allowed fields: standard_name, assessment_profile_name, asset_group_name, score, evaluation_time", "err_extra": {} } } } } } } }, "BadRequest": { "description": "Bad request - invalid input parameters", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "examples": { "invalid_field": { "summary": "Invalid filter field", "value": { "reply": { "err_code": 400, "err_msg": "Invalid filter field. Allowed fields: name, category, subcategory, is_custom, creation_time, created_by, modified_by, modification_time, id, description", "err_extra": {} } } }, "invalid_operator": { "summary": "Invalid operator for field", "value": { "reply": { "err_code": 400, "err_msg": "Invalid operator 'range' for field 'name'. Allowed operators: eq, neq, contains, not_contains", "err_extra": {} } } }, "missing_required": { "summary": "Missing required parameter", "value": { "reply": { "err_code": 400, "err_msg": "Missing required parameter: control_name", "err_extra": {} } } }, "invalid_custom_value": { "summary": "Invalid is_custom value", "value": { "reply": { "err_code": 400, "err_msg": "Invalid value for is_custom field. Allowed values: yes, no", "err_extra": {} } } } } } } }, "NotFound": { "description": "Resource not found", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "reply": { "err_code": 404, "err_msg": "Control not found", "err_extra": { "control_id": "eee175cb00ef4da4a0e3091b1ee77368" } } } } } }, "InternalServerError": { "description": "Internal server error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" }, "example": { "reply": { "err_code": 500, "err_msg": "Failed to retrieve controls", "err_extra": {} } } } } } }, "examples": { "get_standards_basic_request": { "summary": "Basic request for all standards only first 50 elements", "value": { "request_data": { "search_from": 0, "search_to": 49 } } }, "get_standards_filtered_request": { "summary": "Filtered request for first 25 custom standards with aws label", "value": { "request_data": { "filters": [ { "field": "is_custom", "operator": "in", "value": [ "yes" ] }, { "field": "labels", "operator": "contains", "value": "aws" } ], "sort": { "field": "insertion_time", "keyword": "desc" }, "search_from": 0, "search_to": 24 } } }, "get_standards_response": { "summary": "Standards response example", "value": { "reply": { "total_count": 17, "result_count": 2, "standards": [ { "id": "394fc8fc210645f6af8bb4267321482a", "name": "standard name", "description": "convert ...", "version": "", "assessments_profiles_count": 0, "controls_ids": [ "0b0b5304d06d44ffb3d7465855378185", "98497e7bf21f413b9df0d84ccb8857d0" ], "labels": [ "aws", "azure", "gcp" ], "revision": -6043636965775741000, "publisher": null, "release_date": "2025-06-18", "created_date": "2025-06-18", "created_by": "Palo Alto Networks", "insert_ts": 1750247438000, "modify_ts": 1750247439000, "is_custom": false }, { "id": "36ed307155e446938f157e3ed214fd72", "name": "standard name ...", "description": "", "version": "", "assessments_profiles_count": 0, "controls_ids": [ "0b0b5304d06d44ffb3d7465855378185", "98497e7bf21f413b9df0d84ccb8857d0" ], "labels": [ "aws" ], "revision": 8279863739578999000, "publisher": null, "release_date": "2025-05-18", "created_date": "2025-05-18", "created_by": "Palo Alto Networks", "insert_ts": 1750247311000, "modify_ts": 1750247313000, "is_custom": false } ] } } }, "get_standard_request": { "summary": "Get single standard by ID", "value": { "request_data": { "id": "eee175cb04da4a0e3091b1ee77368" } } }, "get_standard_response": { "summary": "Single standard response", "value": { "standard": { "id": "36ed307155e446938f157e3ed214fd72", "name": "standard name ...", "description": "", "version": "", "assessments_profiles_count": 0, "controls_ids": [ "0b0b5304d06d44ffb3d7465855378185", "98497e7bf21f413b9df0d84ccb8857d0" ], "labels": [ "aws", "azure", "gcp" ], "revision": 8279863739578999000, "publisher": null, "release_date": "2025-06-18", "created_date": "2025-06-18", "created_by": "Palo Alto Networks", "insert_ts": 1750247411000, "modify_ts": 1750247413000, "is_custom": true } } }, "add_standard_response": { "summary": "Standard creation response", "value": { "reply": { "success": true } } }, "edit_standard_request": { "summary": "Edit existing standard", "value": { "request_data": { "id": "48e2f6a9fdc049479e9c6a8eda0bd163", "standard_name": "test new name" } } }, "edit_standard_response": { "summary": "Standard update response", "value": { "reply": { "success": true } } }, "delete_standard_request": { "summary": "Delete standard by ID", "value": { "request_data": { "id": "f9f764717b284e9483f9c1210ed3149d" } } }, "delete_standard_response": { "summary": "Standard deletion response", "value": { "reply": { "success": true } } }, "filter_by_labels_request": { "summary": "Filter standards by labels", "value": { "request_data": { "filters": [ { "field": "labels", "operator": "contains", "value": "security" }, { "field": "is_custom", "operator": "in", "value": [ "yes" ] } ] } } }, "filter_by_time_range_request": { "summary": "Filter standards by creation time", "value": { "request_data": { "filters": [ { "field": "insertion_time", "operator": "gte", "value": 1640995200000 }, { "field": "insertion_time", "operator": "lte", "value": 1672531200000 } ], "sort": { "field": "insertion_time", "keyword": "desc" } } } } }, "parameters": { "StandardIdParam": { "name": "standard_id", "in": "path", "required": true, "description": "UUID of the compliance standard", "schema": { "type": "string", "format": "uuid" } }, "CategoryIdParam": { "name": "category_id", "in": "path", "required": true, "description": "UUID of the category or subcategory", "schema": { "type": "string", "format": "uuid" } }, "ControlIdParam": { "name": "control_id", "in": "path", "required": true, "description": "UUID of the control", "schema": { "type": "string", "format": "uuid" } }, "OffsetParam": { "name": "offset", "in": "query", "required": false, "description": "Pagination offset (0-based)", "schema": { "type": "integer", "minimum": 0, "default": 0 } }, "LimitParam": { "name": "limit", "in": "query", "required": false, "description": "Maximum number of results to return (PAPI). Default 50, max 200.", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 50 } }, "JobIdParam": { "name": "job_id", "in": "path", "required": true, "description": "UUID of the async import or export job", "schema": { "type": "string", "format": "uuid" } } }, "securitySchemes": { "XDRAuth": { "type": "apiKey", "in": "header", "name": "x-xdr-auth-id", "description": "API Key ID for authentication" }, "XDRAuthToken": { "type": "apiKey", "in": "header", "name": "Authorization", "description": "API Key for authentication" } } }, "security": [ { "XDRAuth": [], "XDRAuthToken": [] } ], "tags": [ { "name": "Assessment profiles", "description": "Operations for managing assessment profiles" }, { "name": "Assessment results", "description": "Operations for managing assessment results" }, { "name": "Categories", "description": "Operations for retrieving categories and subcategories" }, { "name": "Compliance Assets", "description": "Operations for retrieving compliance assets" }, { "name": "Controls", "description": "Operations for managing compliance controls" }, { "name": "Export", "description": "Operations for standard export" }, { "name": "Import", "description": "Operations for standard import" }, { "name": "Reports", "description": "Operations for managing reports" }, { "name": "Results", "description": "Operations for retrieving compliance results and findings" }, { "name": "Rules", "description": "Operations for managing compliance rules" }, { "name": "Standards", "description": "Operations for managing standards" } ] }