{ "openapi": "3.0.1", "x-hideTryItPanel": true, "info": { "version": "Cortex Cloud", "title": "Unified Rule APIs", "description": "Manage linked Cloud Security and AppSec rule pairs through a single unified endpoint. Each unified rule consists of a Cloud Security rule (which detects misconfigurations in deployed cloud infrastructure) and a linked AppSec rule (which detects the same misconfiguration in Infrastructure as Code before deployment). The AppSec rule ID is the primary identifier for all unified rule operations.\n\n**Required License:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "contact": { "email": "docs-cortex@paloaltonetworks.com", "name": "Cortex Documentation Team", "url": "https://cortex-docs.paloaltonetworks.com/" }, "license": { "name": "Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on." } }, "servers": [ { "url": "https://api-yourfqdn", "description": "API Base URL" } ], "tags": [ { "name": "Unified Rules", "x-page-title": "Unified Rules", "description": "Manage linked Cloud Security and AppSec rule pairs through a single unified endpoint." } ], "paths": { "/public_api/appsec/v1/unified-rules": { "get": { "operationId": "ListUnifiedRules", "summary": "List unified rules", "description": "Returns a paginated list of all unified rule pairs. Each item in the response contains both the linked AppSec and Cloud Security rule details.\n\nThe top-level `id` field in each result is always the **AppSec rule ID**. Use this ID for all subsequent GET, PUT, and DELETE operations on a specific unified rule.\n\nUse the `nextOffset` field in the response to retrieve the next page of results. When `nextOffset` is `null`, there are no more results.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "tags": [ "Unified Rules" ], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "query", "name": "severities", "required": false, "description": "Filter unified rules by severity level. Returns only rules whose AppSec rule matches one of the specified severity values.", "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Severity" } } }, { "in": "query", "name": "categories", "required": false, "description": "Filter unified rules by AppSec rule category. Returns only rules whose AppSec rule belongs to one of the specified categories.", "schema": { "type": "array", "items": { "$ref": "#/components/schemas/Category" } } }, { "in": "query", "name": "cloudProviders", "required": false, "description": "Filter unified rules by cloud provider. Returns only rules associated with one of the specified cloud providers.", "schema": { "type": "array", "items": { "$ref": "#/components/schemas/CloudProvider" } } }, { "in": "query", "name": "offset", "required": false, "description": "The number of unified rules to skip before returning results. Used for pagination together with `limit`. Set to `0` to start from the first result.", "schema": { "default": 0, "format": "double", "type": "number" } }, { "in": "query", "name": "limit", "required": false, "description": "The maximum number of unified rules to return per page. Used for pagination together with `offset`.", "schema": { "default": 100, "format": "double", "type": "number" } } ], "responses": { "200": { "description": "Ok. Returns a paginated list of unified rule pairs. Each item contains the linked AppSec and Cloud Security (CSPM) rule details.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicUnifiedRuleListResponse" }, "examples": { "Example 1": { "value": { "offset": 0, "nextOffset": 10, "items": [ { "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "appsec": { "category": "COMPUTE", "cloudProvider": null, "createdAt": { "value": "2025-06-15T09:30:00.000Z" }, "cspmRuleId": "f1e2d3c4-b5a6-4978-9012-3456789abcde", "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.", "detectionMethod": "IaC Security", "domain": "POSTURE", "findingTypeId": 30040018, "frameworks": [ { "definition": "metadata:\n name: S3 bucket ACL restriction\n category: compute\n severity: high\nscope:\n provider: aws\ndefinition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket\n attribute: acl\n operator: not_equals\n value: public-read\n", "definitionLink": null, "name": "TERRAFORM", "remediationDescription": null, "remediationIds": [], "resourceTypes": [] } ], "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "isCustom": true, "isEnabled": true, "labels": [ "storage", "iac-unified" ], "name": "S3 bucket ACL restriction", "owner": "CAS", "scanner": "IAC", "severity": "HIGH", "subCategory": "OVERPROVISIONED", "updatedAt": { "value": "2025-06-15T09:30:00.000Z" }, "findingCategory": "Configuration", "findingDocs": "Custom IaC rule for Compute Overprovisioned", "mitreTactics": [], "mitreTechniques": [], "shortDescription": null, "complianceStandards": [] }, "cspm": { "id": "f1e2d3c4-b5a6-4978-9012-3456789abcde", "name": "S3 bucket ACL restriction", "findingTypeId": 60100018, "description": "Detects S3 buckets with a public-read ACL.", "type": "config", "query": { "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'", "json": null, "rql": null }, "assetTypes": [ "S3 Bucket" ], "severity": "high", "enabled": false, "provider": [ "aws" ], "labels": [ "storage", "iac-unified" ], "systemDefault": false, "lastModifiedBy": "Public API - 1" }, "warnings": [] } ], "warnings": [] } } } } } } }, "security": [], "x-scope": [ "external" ] }, "post": { "operationId": "CreateUnifiedRule", "summary": "Create a unified rule", "description": "Creates a linked Cloud Security (CSPM) and AppSec rule pair in a single operation.\n\nThe endpoint first creates the Cloud Security rule through the Detection Rules API, then creates the AppSec rule with the Cloud Security rule ID `cspmRuleId` automatically injected to link the two rules. If the AppSec rule creation fails, the Cloud Security rule is automatically rolled back (deleted) to prevent orphaned rules.\n\n> **Note:** The `cspmRuleId` and `shouldConnectToCspm` fields are managed automatically by this endpoint. Do not include them in the `appsec` request body.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "tags": [ "Unified Rules" ], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true } ], "requestBody": { "required": true, "description": "The CSPM and AppSec IaC rule definitions for the unified rule pair to create. Both the `cspm` and `appsec` objects are required.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateUnifiedRuleRequest" }, "examples": { "Example 1": { "value": { "cspm": { "name": "S3 bucket ACL restriction", "severity": "HIGH", "description": "Detects S3 buckets with a public-read ACL.", "providers": [ "aws" ], "assetTypes": [ "S3_BUCKET" ], "query": { "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'", "type": "config" }, "metadata": { "issue": { "category": "Storage" } }, "enabled": false, "labels": [ "storage", "iac-unified" ] }, "appsec": { "name": "S3 bucket ACL restriction", "severity": "HIGH", "scanner": "IAC", "category": "COMPUTE", "subCategory": "OVERPROVISIONED", "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.", "labels": [ "storage", "iac-unified" ], "frameworks": [ { "name": "TERRAFORM", "definition": "metadata:\n name: S3 bucket ACL restriction\n guidelines: Detects S3 buckets with a public-read ACL.\n category: general\n severity: HIGH\nscope:\n provider: aws\ndefinition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket\n attribute: acl\n operator: not_equals\n value: public-read" } ] } } } } } } }, "responses": { "201": { "description": "Created. The unified rule pair was created successfully. The top-level `id` field is the AppSec rule ID and serves as the primary identifier for all subsequent operations on this unified rule.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicUnifiedRuleResponse" }, "examples": { "Example 1": { "value": { "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "cspm": { "id": "f1e2d3c4-b5a6-4978-9012-3456789abcde", "name": "S3 bucket ACL restriction", "type": "DETECTION", "query": { "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'", "type": "config" }, "owner": "CSPM", "severity": "HIGH", "version": "2025.06.15.1234567890", "description": "Detects S3 buckets with a public-read ACL.", "deleted": false, "enabled": false, "systemDefault": false, "labels": [ "storage", "iac-unified" ], "createdBy": "Public API - 1", "lastModifiedBy": "Public API - 1", "creationOn": 1749977400000, "lastModificationOn": 1749977400000, "providerType": "CLOUD", "providers": [ "aws" ], "assetTypes": [ "S3_BUCKET" ], "metadata": { "issue": { "category": "Storage" } }, "complianceMetadata": [] }, "appsec": { "category": "COMPUTE", "cloudProvider": null, "createdAt": { "value": "2025-06-15T09:30:00.000Z" }, "cspmRuleId": "f1e2d3c4-b5a6-4978-9012-3456789abcde", "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.", "detectionMethod": "IaC Security", "domain": "POSTURE", "findingTypeId": 30040018, "frameworks": [ { "definition": "metadata:\n name: S3 bucket ACL restriction\n guidelines: Detects S3 buckets with a public-read ACL.\n category: compute\n severity: high\nscope:\n provider: aws\ndefinition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket\n attribute: acl\n operator: not_equals\n value: public-read\n", "definitionLink": null, "name": "TERRAFORM", "remediationDescription": null, "remediationIds": [], "resourceTypes": [] }, { "definition": "metadata:\n name: S3 bucket ACL restriction\n guidelines: Detects S3 buckets with a public-read ACL.\n category: compute\n severity: high\nscope:\n provider: aws\ndefinition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket\n attribute: acl\n operator: not_equals\n value: public-read\n", "definitionLink": null, "name": "TERRAFORMPLAN", "remediationDescription": null, "remediationIds": [], "resourceTypes": [] } ], "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "isCustom": true, "isEnabled": true, "labels": [ "storage", "iac-unified" ], "name": "S3 bucket ACL restriction", "owner": "CAS", "scanner": "IAC", "severity": "HIGH", "subCategory": "OVERPROVISIONED", "updatedAt": { "value": "2025-06-15T09:30:00.000Z" }, "findingCategory": "Configuration", "findingDocs": "Custom IaC rule for Compute Overprovisioned", "mitreTactics": [], "mitreTechniques": [], "shortDescription": null, "complianceStandards": [] } } } } } } }, "400": { "description": "Bad Request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnifiedRuleErrorPayload" }, "examples": { "Validation error": { "value": { "error": "Missing required field 'severity' in appsec rule definition.", "code": "APPSEC_VALIDATION_FAILED", "retriable": false } } } } } }, "500": { "description": "Internal Server Error.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnifiedRuleErrorPayload" }, "examples": { "AppSec creation failed with successful rollback": { "value": { "error": "AppSec rule creation failed. The CSPM rule was automatically rolled back.", "code": "APPSEC_CREATE_FAILED", "retriable": true } }, "AppSec creation failed with rollback failure": { "value": { "error": "AppSec rule creation failed and the CSPM rule rollback also failed. The CSPM rule may be orphaned.", "code": "ROLLBACK_FAILED", "orphanedCspmRuleId": "cspm-rule-xyz789", "retriable": false } } } } } }, "503": { "description": "Service Unavailable. ", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UnifiedRuleErrorPayload" }, "examples": { "CSPM service unavailable": { "value": { "error": "The CSPM Detection Rules API is temporarily unavailable. Please retry after a short delay.", "code": "CSPM_CREATE_FAILED", "retriable": true } } } } } } }, "security": [], "x-scope": [ "external" ] } }, "/public_api/appsec/v1/unified-rules/{ruleId}": { "get": { "operationId": "GetUnifiedRule", "summary": "Get a unified rule", "description": "Returns the full details of a specific unified rule pair, including both the linked AppSec and Cloud Security (CSPM) rule objects.\n\nThe `ruleId` path parameter is the **AppSec rule ID**, which is the primary identifier for the unified rule pair. You can retrieve this value from the `id` field in the response of [List unified rules](#operation/ListUnifiedRules).\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "tags": [ "Unified Rules" ], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "path", "name": "ruleId", "required": true, "description": "The unique identifier of the unified rule to retrieve. This is the **AppSec rule ID**, which serves as the primary identifier for the unified rule pair. You can retrieve this value from the `id` field in the response of [List unified rules](#operation/ListUnifiedRules).", "schema": { "type": "string" }, "example": "appsec-rule-abc123" } ], "responses": { "200": { "description": "Ok. Returns the full details of the unified rule pair, including both the AppSec and CSPM rule objects.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicUnifiedRuleResponse" }, "examples": { "Example 1": { "value": { "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "appsec": { "category": "COMPUTE", "cloudProvider": null, "createdAt": { "value": "2025-06-15T09:30:00.000Z" }, "cspmRuleId": "f1e2d3c4-b5a6-4978-9012-3456789abcde", "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.", "detectionMethod": "IaC Security", "domain": "POSTURE", "findingTypeId": 30040018, "frameworks": [ { "definition": "metadata:\n name: S3 bucket ACL restriction\n category: compute\n severity: high\nscope:\n provider: aws\ndefinition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket\n attribute: acl\n operator: not_equals\n value: public-read\n", "definitionLink": null, "name": "TERRAFORM", "remediationDescription": null, "remediationIds": [], "resourceTypes": [] }, { "definition": "metadata:\n name: S3 bucket ACL restriction\n category: compute\n severity: high\nscope:\n provider: aws\ndefinition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket\n attribute: acl\n operator: not_equals\n value: public-read\n", "definitionLink": null, "name": "TERRAFORMPLAN", "remediationDescription": null, "remediationIds": [], "resourceTypes": [] } ], "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "isCustom": true, "isEnabled": true, "labels": [ "storage", "iac-unified" ], "name": "S3 bucket ACL restriction", "owner": "CAS", "scanner": "IAC", "severity": "HIGH", "subCategory": "OVERPROVISIONED", "updatedAt": { "value": "2025-06-15T09:30:00.000Z" }, "findingCategory": "Configuration", "findingDocs": "Custom IaC rule for Compute Overprovisioned", "mitreTactics": [], "mitreTechniques": [], "shortDescription": null, "complianceStandards": [] }, "cspm": { "id": "f1e2d3c4-b5a6-4978-9012-3456789abcde", "name": "S3 bucket ACL restriction", "findingTypeId": 60100018, "description": "Detects S3 buckets with a public-read ACL.", "type": "config", "query": { "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'", "json": null, "rql": null }, "assetTypes": [ "S3 Bucket" ], "severity": "high", "enabled": false, "provider": [ "aws" ], "labels": [ "storage", "iac-unified" ], "systemDefault": false, "lastModifiedBy": "Public API - 1" }, "warnings": [] } } } } } } }, "security": [], "x-scope": [ "external" ] }, "put": { "operationId": "UpdateUnifiedRule", "summary": "Update a unified rule", "description": "Updates one or both rules in a unified rule pair in a single request.\n\nYou can update only the AppSec rule, only the Cloud Security (CSPM) rule, or both simultaneously by including the respective rule object in the request body. Include only the fields you want to change — omitted fields are left unchanged.\n\nThe `ruleId` path parameter is the **AppSec rule ID**. You can retrieve this value from the `id` field in the response of [List unified rules](#operation/ListUnifiedRules).\n\n**Partial failure handling:** If one update succeeds and the other fails, the endpoint returns a `207 Multi-Status` response with per-rule status details indicating which update succeeded and which failed.\n\n> **Note:** The `cspmRuleId` field on the AppSec rule cannot be changed through this endpoint. The CSPM link is managed by the unified rule system.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "tags": [ "Unified Rules" ], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "path", "name": "ruleId", "required": true, "description": "The unique identifier of the unified rule to update. This is the **AppSec rule ID**, which serves as the primary identifier for the unified rule pair. You can retrieve this value from the `id` field in the response of [List unified rules](#operation/ListUnifiedRules).", "schema": { "type": "string" }, "example": "appsec-rule-abc123" } ], "requestBody": { "required": true, "description": "The fields to update on the CSPM rule, the AppSec rule, or both. Include only the rule objects and fields you want to change.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateUnifiedRuleRequest" }, "examples": { "Update AppSec rule labels only": { "value": { "appsec": { "labels": [ "storage", "iac-unified", "reviewed" ] } } }, "Example 1": { "value": { "cspm": { "id": "string", "type": "string", "name": "string", "severity": "string", "owner": "string", "description": "string", "enabled": true, "deleted": true, "systemDefault": true, "assetTypes": [ "string" ], "providers": [ "string" ], "labels": [ "string" ], "complianceMetadata": [ { "property1": null, "property2": null } ], "metadata": { "property1": null, "property2": null }, "query": { "property1": null, "property2": null }, "version": "string", "lastModifiedBy": "string" }, "appsec": { "labels": [ "string" ] } } } } } } }, "responses": { "200": { "description": "Ok. Both rules were updated successfully. Returns the updated unified rule pair.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicUnifiedRuleResponse" }, "examples": { "Example 1": { "value": { "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "appsec": { "category": "COMPUTE", "cloudProvider": null, "createdAt": { "value": "2025-06-15T09:30:00.000Z" }, "cspmRuleId": "f1e2d3c4-b5a6-4978-9012-3456789abcde", "description": "Detects Terraform aws_s3_bucket resources with a public-read ACL.", "detectionMethod": "IaC Security", "domain": "POSTURE", "findingTypeId": 30040018, "frameworks": [ { "definition": "metadata:\n name: S3 bucket ACL restriction\n category: compute\n severity: high\nscope:\n provider: aws\ndefinition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket\n attribute: acl\n operator: not_equals\n value: public-read\n", "definitionLink": null, "name": "TERRAFORM", "remediationDescription": null, "remediationIds": [], "resourceTypes": [] } ], "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "isCustom": true, "isEnabled": true, "labels": [ "storage", "iac-unified", "reviewed" ], "name": "S3 bucket ACL restriction", "owner": "CAS", "scanner": "IAC", "severity": "HIGH", "subCategory": "OVERPROVISIONED", "updatedAt": { "value": "2025-06-15T10:15:00.000Z" }, "findingCategory": "Configuration", "findingDocs": "Custom IaC rule for Compute Overprovisioned", "mitreTactics": [], "mitreTechniques": [], "shortDescription": null, "complianceStandards": [] }, "cspm": { "id": "f1e2d3c4-b5a6-4978-9012-3456789abcde", "name": "S3 bucket ACL restriction", "findingTypeId": 60100018, "description": "Detects S3 buckets with a public-read ACL.", "type": "config", "query": { "xql": "config from cloud.resource where api.name = 'aws-s3-bucket'", "json": null, "rql": null }, "assetTypes": [ "S3 Bucket" ], "severity": "high", "enabled": false, "provider": [ "aws" ], "labels": [ "storage", "iac-unified" ], "systemDefault": false, "lastModifiedBy": "Public API - 1" }, "warnings": [] } } } } } } }, "security": [], "x-scope": [ "external" ] }, "delete": { "operationId": "DeleteUnifiedRule", "summary": "Delete a unified rule", "description": "Deletes both the AppSec and Cloud Security rules in a unified rule pair in a single operation.\n\nThe `ruleId` path parameter is the **AppSec rule ID**. You can retrieve this value from the `id` field in the response of [List unified rules](#operation/ListUnifiedRules).\n\n**Partial failure handling:** The AppSec rule is always deleted first, followed by the linked Cloud Security rule. If the AppSec rule is deleted successfully but the subsequent Cloud Security rule deletion fails, the endpoint returns a `207 Multi-Status` response with per-rule status details, and the Cloud Security rule may be left orphaned. There is no scenario where the Cloud Security rule is deleted but the AppSec rule deletion fails.\n\n**Required license:** Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.", "tags": [ "Unified Rules" ], "parameters": [ { "schema": { "type": "string", "example": "your_api_key_here" }, "in": "header", "name": "Authorization", "description": "{api_key}", "required": true }, { "schema": { "type": "string", "example": "1" }, "in": "header", "name": "x-xdr-auth-id", "description": "{api_key_id}", "required": true }, { "in": "path", "name": "ruleId", "required": true, "description": "The unique identifier of the unified rule to delete. This is the **AppSec rule ID**, which serves as the primary identifier for the unified rule pair. You can retrieve this value from the `id` field in the response of [List unified rules](#operation/ListUnifiedRules).", "schema": { "type": "string" }, "example": "appsec-rule-abc123" } ], "responses": { "204": { "description": "Deleted. Both the AppSec and CSPM rules were deleted successfully. No content is returned." }, "207": { "description": "Multi-Status. The AppSec rule is always deleted first. This status is returned when the AppSec rule was deleted successfully but the subsequent Cloud Security rule deletion failed, potentially leaving the Cloud Security rule orphaned. The response body contains per-rule status details (success for appsec, failed for cspm).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicUnifiedRuleMultiStatusResponse" }, "examples": { "Example 1": { "value": { "id": "APPSEC_CUSTOM_a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "appsec": { "status": "success" }, "cspm": { "status": "failed", "error": "The CSPM Detection Rules API is temporarily unavailable.", "cspmRuleId": "f1e2d3c4-b5a6-4978-9012-3456789abcde" }, "warnings": [ "The AppSec rule was deleted, but the linked Cloud Security rule f1e2d3c4-b5a6-4978-9012-3456789abcde could not be deleted and may be orphaned." ] } } } } } }, "404": { "description": "Not Found", "content": { "application/json": { "schema": { "type": "object", "properties": { "errorCode": { "type": "string", "x-stoplight": { "id": "3unfpnxibbcea" } }, "message": { "type": "string", "x-stoplight": { "id": "vnnm8viqtg4ll" } } } }, "examples": { "Example 1": { "value": { "errorCode": "_NotFoundError", "message": "AppSec rule appsec-rule-abc123 not found" } } } } } } }, "security": [], "x-scope": [ "external" ] } } }, "components": { "schemas": { "Severity": { "description": "The priority level assigned to findings detected by the rule.\n- `CRITICAL` — Highest priority. Requires immediate attention.\n- `HIGH` — High priority. Should be addressed promptly.\n- `MEDIUM` — Medium priority. Should be addressed in the near term.\n- `LOW` — Low priority. Address when resources allow.\n- `INFO` — Informational only. No immediate action required.", "enum": [ "CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO" ], "type": "string" }, "CloudProvider": { "description": "The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is `null`.", "enum": [ "ALIBABA_CLOUD", "AWS", "Azure", "GCP", "ORACLE", "OTHER" ], "example": "GCP", "type": "string" }, "Category": { "description": "The security category of an AppSec rule. Categories classify the type of security issue the rule detects.", "enum": [ "AI_ML", "API_KEYS", "API_SECURITY", "ACCESS_AUTH", "ARTIFACT_INTEGRITY_VALIDATION", "BUFFER", "SUPPLY_CHAIN", "CLOUD_SERVICE_PROVIDER_KEYS", "COMPUTE", "CONFIGURATION_DEPLOYMENT", "CREDENTIAL_HYGIENE", "CREDENTIALS_MGMT", "CRYPTOGRAPHIC", "DATA_EXPOSURE", "DATA_PROTECTION", "DATABASE_CREDENTIALS", "DEPENDENCY_CHAINS", "DESERIALIZATION", "DRIFT", "ENCRYPTION", "ENCRYPTION_KEYS", "ENVIRONMENT_VARIABLES", "FLOW_CONTROL_MECHANISM", "GENERAL", "IAM", "IDENTIFY_ACCESS_MANAGEMENT", "IDENTITY_ACCESS_MANAGEMENT", "INJECTION", "INPUT_VALIDATION", "KUBERNETES", "LICENSES", "LOGGING", "LOGGING_AND_VISIBILITY", "MONITORING", "NETWORK_RISKS", "NETWORKING", "NON_PERMISSIVE", "OTHER_SAST", "PIPELINE_BASED_ACCESS_CONTROLS", "PIPELINE_CONFIGURATION", "PIPELINE_FLOW_CONTROL", "POLICY3D", "PPE", "PUBLIC", "PUBLIC_EXPOSURE", "RESOURCE_MGMT", "SCM_SYSTEM_CONFIGURATION", "SSH_KEYS", "SAST", "SCA", "SECRETS", "SECURE_CODING", "SENSITIVE_TOKENS", "SESSION_MGMT", "STORAGE", "STRONG_COPYLEFT", "SUPPLY CHAIN", "SYSTEM_CONFIGURATION", "THIRD_PARTY_SERVICES", "TOOLS_OPERATIONAL_RISKS", "VULNERABILITIES", "WEAK_COPYLEFT" ], "type": "string" }, "Scanner": { "description": "The type of security scanner used to detect findings.\n- `CICD` — CI/CD pipeline security scanner.\n- `IAC` — Infrastructure as Code (IaC) security scanner.\n- `SAST` — Static Application Security Testing scanner.\n- `SCA` — Software Composition Analysis scanner.\n- `SECRETS` — Secrets detection scanner.", "enum": [ "CICD", "IAC", "SAST", "SCA", "SECRETS" ], "type": "string", "example": "IAC" }, "CustomRuleScanner": { "description": "The scanner type supported for custom AppSec rules. Only IaC and Secrets scanners support custom rule creation.\n- `IAC` — Infrastructure as Code security scanner.\n- `SECRETS` — Secrets detection scanner.", "enum": [ "IAC", "SECRETS" ], "type": "string" }, "FrameworkName": { "description": "The IaC framework or language that a rule definition applies to.", "enum": [ "ANSIBLE", "ARM", "BICEP", "CI_CD_AZURE_ORG", "CI_CD_AZURE_REPO", "CI_CD_BITBUCKET_ORG", "CI_CD_BITBUCKET_REPO", "CI_CD_CIMATCH", "CI_CD_CIRCLE_CI", "CI_CD_CROSS_SYSTEM", "CI_CD_DEPPY", "CI_CD_GITHUB_ORG", "CI_CD_GITHUB_REPO", "CI_CD_GITLAB_ORG", "CI_CD_GITLAB_REPO", "CI_CD_JENKINS_CI", "CI_CD_SUPPLY_CHAIN_TOOLS", "CLOUDFORMATION", "DOCKERFILE", "GIT", "HELM", "KUBERNETES", "KUSTOMIZE", "OPENAPI", "SECRETS", "SERVERLESS", "TERRAFORM", "TERRAFORMPLAN" ], "type": "string" }, "FindingCategory": { "description": "The high-level category of the security finding detected by the rule.\n- `Code` — A finding related to source code or application logic.\n- `Configuration` — A finding related to infrastructure or service misconfiguration.\n- `Data` — A finding related to data exposure or data handling.\n- `Vulnerability` — A finding related to a known software vulnerability.", "enum": [ "Code", "Configuration", "Data", "Vulnerability" ], "type": "string" }, "LocationInDeliveryChain": { "description": "Represents the stage in the software development lifecycle (SDLC) where the rule applies.\n- `BUILD` — The build stage of the pipeline.\n- `DEPENDENCIES` — The dependency management stage.\n- `DEPLOY` — The deployment stage.\n- `DEV_SOURCE` — Deprecated. Use `DEVELOPMENT` instead.\n- `DEVELOPMENT` — The development stage (source code).\n- `Runtime` — The runtime environment.\n- `SOURCE` — The source code repository stage.", "enum": [ "BUILD", "DEPENDENCIES", "DEPLOY", "DEV_SOURCE", "DEVELOPMENT", "Runtime", "SOURCE" ], "type": "string" }, "CustomRuleIacCategory": { "description": "The security category for a custom IaC rule.\n- `AI_ML` — AI and machine learning resource security.\n- `COMPUTE` — Compute resource security.\n- `IAM` — Identity and access management.\n- `KUBERNETES` — Kubernetes cluster security.\n- `LOGGING` — Logging and audit trail configuration.\n- `MONITORING` — Monitoring and alerting configuration.\n- `NETWORKING` — Network security and exposure.\n- `PUBLIC` — Public exposure of resources.\n- `STORAGE` — Storage resource security.", "enum": [ "AI_ML", "COMPUTE", "IAM", "KUBERNETES", "LOGGING", "MONITORING", "NETWORKING", "PUBLIC", "STORAGE" ], "type": "string" }, "CustomRuleSecretsCategory": { "description": "The security category for a custom Secrets rule.\n- `API_KEYS` — API key secrets.\n- `DATABASE_CREDENTIALS` — Database credential secrets.\n- `ENCRYPTION_KEYS` — Encryption key secrets.\n- `CLOUD_SERVICE_PROVIDER_KEYS` — Cloud provider access key secrets.\n- `SSH_KEYS` — SSH private key secrets.\n- `ENVIRONMENT_VARIABLES` — Secrets exposed in environment variables.\n- `SENSITIVE_TOKENS` — Sensitive authentication tokens.\n- `THIRD_PARTY_SERVICES` — Credentials for third-party services.", "enum": [ "API_KEYS", "DATABASE_CREDENTIALS", "ENCRYPTION_KEYS", "CLOUD_SERVICE_PROVIDER_KEYS", "SSH_KEYS", "ENVIRONMENT_VARIABLES", "SENSITIVE_TOKENS", "THIRD_PARTY_SERVICES" ], "type": "string" }, "CustomRuleCategory": { "description": "The security category for a custom AppSec rule. The accepted values depend on the scanner type: use `CustomRuleIacCategory` values for `IAC` rules and `CustomRuleSecretsCategory` values for `SECRETS` rules.", "anyOf": [ { "$ref": "#/components/schemas/CustomRuleIacCategory" }, { "$ref": "#/components/schemas/CustomRuleSecretsCategory" } ] }, "CustomRuleIacSubCategory": { "description": "The subcategory that further classifies the type of security issue within an IaC rule category. Subcategories are only applicable to `IAC` scanner rules.", "enum": [ "ACCESS_CONTROL", "ADMIN_INTERFACES", "ALERTING", "ALERTING_AND_NOTIFICATIONS", "APIS", "AUTHENTICATION_POLICIES", "BACKUPS", "CREDENTIAL_EXPOSURE", "DATABASE_ENDPOINTS", "DEFAULT_CREDENTIALS_OR_AUTH", "DISABLED_OR_MISSING", "EGRESS_CONTROLS", "ENCRYPTION", "ENCRYPTION_AND_PROTOCOLS", "EXPIRED_KEY_CONTROLS", "FLOW_LOGS", "FORMATS", "GUARDRAILS", "INGRESS_CONTROLS", "LOAD_BALANCING", "LOGGING_AND_MONITORING", "MANAGEMENT_SERVICES_EXPOSURE", "MFA", "NATIVE_SECURITY_CONTROLS", "NETWORK_POLICIES", "OVERPROVISIONED", "OVERLY_PERMISSIVE", "PERFORMANCE_MONITORING", "PERMISSIONS", "PUBLIC_EXPOSURE", "REDUNDANCY", "REPLICATION", "RESOURCE_HEALTH", "RESOURCE_MANAGEMENT", "RETENTION", "RISKY_MODELS", "ROLE_SEPARATION", "SENSITIVE_PORTS", "SHARED", "STARTUP_SCRIPT_LEAKS", "STORAGE", "STORAGE_BUCKETS", "TAGS_AND_METADATA", "UNDER_USE", "UNINTEGRATED", "UNSANCTIONED_RESOURCE_OR_TYPE", "UNUSED", "VERSIONING", "VPC_VCN_VNET" ], "type": "string" }, "Record_string.unknown_": { "properties": {}, "additionalProperties": {}, "type": "object", "description": "A generic key-value map where keys are strings and values can be any type. Used for flexible metadata and query structures." }, "Control": { "description": "Represents a single compliance control within a compliance standard.", "properties": { "controlDefinition": { "type": "string", "description": "The unique identifier or reference code for the compliance control (for example, `CIS 2.1.1`)." }, "controlName": { "type": "string", "description": "The human-readable name of the compliance control." } }, "required": [ "controlDefinition", "controlName" ], "type": "object", "additionalProperties": false }, "ComplianceStandard": { "description": "Represents a compliance standard and its associated controls that a rule maps to.", "properties": { "controls": { "items": { "$ref": "#/components/schemas/Control" }, "type": "array", "description": "The list of compliance controls within this standard that the rule satisfies." }, "standardName": { "type": "string", "description": "The name of the compliance standard (for example, `CIS AWS Foundations Benchmark`)." } }, "required": [ "controls", "standardName" ], "type": "object", "additionalProperties": false }, "RuleFramework": { "description": "Defines the IaC framework or language that a rule applies to, along with its detection definition and remediation guidance.", "properties": { "name": { "type": "string", "nullable": true, "description": "The name of the IaC framework or language this rule applies to (for example, `TERRAFORM`, `CLOUDFORMATION`).", "example": "TERRAFORM" }, "definition": { "type": "string", "nullable": true, "description": "The YAML or structured rule definition used to detect the security issue within this framework.", "example": "metadata:\n name: appsec-test-unified-rule-1784456789\n guidelines: Appsec demo unified-rule\n category: compute\n severity: high\nscope:\n provider: aws\ndefinition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket\n attribute: acl\n operator: not_equals\n value: public-read\n" }, "definitionLink": { "type": "string", "nullable": true, "description": "A URL linking to the external definition or documentation for this framework rule." }, "remediationDescription": { "type": "string", "nullable": true, "description": "A human-readable description of how to remediate the detected issue within this framework." }, "remediationIds": { "items": { "type": "string" }, "type": "array", "nullable": true, "description": "A list of remediation identifiers that link to automated fix actions for this framework." }, "resourceTypes": { "items": { "type": "string" }, "type": "array", "nullable": true, "description": "The list of IaC resource types that this framework rule evaluates (for example, `aws_s3_bucket`)." } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "FrameworkRequestParams": { "description": "The framework-specific definition for a custom AppSec rule, including the detection logic and remediation guidance.", "properties": { "name": { "description": "The IaC framework or language this definition applies to.", "allOf": [ { "$ref": "#/components/schemas/FrameworkName" } ] }, "definition": { "type": "string", "nullable": true, "description": "The YAML rule definition used to detect the security issue within this framework." }, "definitionLink": { "type": "string", "nullable": true, "description": "A URL linking to an external definition for this framework rule." }, "remediationDescription": { "type": "string", "nullable": true, "description": "A human-readable description of how to remediate the detected issue within this framework." } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "CspmQuery": { "description": "The query definition used by a CSPM rule to evaluate cloud resources. Supports multiple query formats — provide at least one.", "properties": { "type": { "type": "string", "description": "The query type that determines how the query is evaluated (for example, `Config`, `Network`, `Event`)." }, "rql": { "type": "string", "description": "The RQL (Resource Query Language) query string used to evaluate cloud resources in Prisma Cloud (for example, `config where cloud.type = 'aws' AND api.name = 'aws-s3api-get-bucket-encryption'`)." }, "xql": { "type": "string", "description": "The XQL (Cortex Query Language) query string used to evaluate cloud resources." }, "json": { "description": "The query expressed as a structured JSON object.", "allOf": [ { "$ref": "#/components/schemas/Record_string.unknown_" } ] }, "prisma_json": { "description": "The query expressed as a structured JSON object in Prisma Cloud format.", "allOf": [ { "$ref": "#/components/schemas/Record_string.unknown_" } ] } }, "type": "object", "additionalProperties": {} }, "CspmRule": { "description": "Represents Cloud Security rule that detects misconfigurations in deployed cloud infrastructure at runtime.", "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "description": "Unique identifier of the CSPM rule.", "example": "98a837af-2f00-4237-950f-65e5334417f5" }, "type": { "type": "string", "description": "The type classification of the CSPM rule (for example, `Config` or `Network`).", "example": "config" }, "name": { "type": "string", "description": "Human-readable display name of the CSPM rule.", "example": "appsec-unified-rule" }, "severity": { "type": "string", "description": "The priority level assigned to findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`.", "example": "HIGH" }, "owner": { "type": "string", "description": "The team or system that owns and maintains this CSPM rule." }, "description": { "type": "string", "description": "A human-readable explanation of what the CSPM rule checks and why it matters." }, "enabled": { "type": "boolean", "description": "Indicates whether the CSPM rule is currently active. When `true`, the rule is enabled." }, "deleted": { "type": "boolean", "description": "Indicates whether the CSPM rule has been soft-deleted. When `true`, the rule is no longer active but its record is retained." }, "systemDefault": { "type": "boolean", "description": "Indicates whether this is a system-provided out-of-the-box rule (`true`) or a custom user-created rule (`false`)." }, "assetTypes": { "type": "array", "description": "The list of cloud asset types that this CSPM rule evaluates (for example, `aws_s3_bucket`).", "items": { "type": "string" } }, "providers": { "type": "array", "description": "The cloud providers associated with this CSPM rule (for example, `AWS`, `Azure`, `GCP`).", "items": { "type": "string", "example": "AWS" } }, "labels": { "type": "array", "description": "User-defined labels assigned to the CSPM rule for organization and filtering.", "items": { "type": "string" } }, "complianceMetadata": { "type": "array", "description": "Compliance framework metadata associated with this rule, such as control IDs and standard names.", "items": { "$ref": "#/components/schemas/Record_string.unknown_" } }, "metadata": { "description": "Additional key-value metadata associated with the CSPM rule.", "allOf": [ { "$ref": "#/components/schemas/Record_string.unknown_" } ] }, "query": { "description": "The query definition used by the CSPM rule to evaluate cloud resources.", "allOf": [ { "$ref": "#/components/schemas/Record_string.unknown_" } ] }, "version": { "type": "string", "description": "The version identifier of the CSPM rule definition." }, "lastModifiedBy": { "type": "string", "description": "The username or identifier of the user who last modified this CSPM rule." } } }, "PublicDetectionRule": { "description": "Represents an AppSec detection rule that identifies security issues in code, IaC configurations, secrets, or CI/CD pipelines.", "type": "object", "additionalProperties": false, "properties": { "category": { "type": "string", "description": "The security category of the rule.", "example": "COMPUTE" }, "cloudProvider": { "allOf": [ { "$ref": "#/components/schemas/CloudProvider" } ], "nullable": true, "description": "The cloud provider associated with this rule." }, "createdAt": { "type": "string", "format": "date-time", "description": "The date and time when the rule was created, in ISO 8601 format.", "example": "2025-07-23T12:37:03.940Z" }, "cspmRuleId": { "type": "string", "description": "The unique identifier of the linked CSPM rule. Present when this AppSec rule is part of a unified rule pair.", "example": "98a837af-2f00-4237-950f-65e5334417f5", "nullable": true }, "description": { "type": "string", "description": "A human-readable explanation of what the rule detects and why it matters.", "example": "AppSec Unified rule" }, "detectionMethod": { "type": "string", "description": "The detection method used by the rule (for example, `IaC Security`, `Secrets Security`).", "example": "IaC Security" }, "domain": { "type": "string", "example": "POSTURE", "description": "The security domain the rule belongs to (for example, `POSTURE`, `APPLICATION`)." }, "findingTypeId": { "type": "number", "format": "double", "description": "The numeric identifier of the finding type associated with this rule.", "example": 30040018 }, "frameworks": { "type": "array", "description": "The list of IaC frameworks or languages this rule applies to, along with their detection definitions.", "nullable": true, "items": { "$ref": "#/components/schemas/RuleFramework" } }, "id": { "type": "string", "description": "Unique identifier of the AppSec detection rule.", "example": "APPSEC_CUSTOM_f3b7d9a1-8c42-4e6b-b1d5-92a7c4e8f103" }, "isCustom": { "type": "boolean", "description": "Indicates whether this is a custom user-created rule (`true`) or a system-provided out-of-the-box rule (`false`).", "example": true }, "isEnabled": { "type": "boolean", "description": "Indicates whether the rule is currently active. When `true`, the rule is enabled.", "example": true }, "labels": { "type": "array", "description": "User-defined labels assigned to the rule for organization and filtering.", "example": [ "Appsec unified rule" ], "items": { "type": "string" } }, "name": { "type": "string", "description": "Name of the AppSec rule.", "example": "appsec-unified-rule" }, "owner": { "type": "string", "description": "The team or system that owns and maintains this rule.", "example": "CAS" }, "scanner": { "$ref": "#/components/schemas/Scanner" }, "severity": { "$ref": "#/components/schemas/Severity" }, "subCategory": { "type": "string", "description": "The subcategory that further classifies the type of security issue within the rule's category.", "example": "OVERPROVISIONED" }, "updatedAt": { "type": "string", "format": "date-time", "description": "The date and time when the rule was last updated, in ISO 8601 format.", "example": "2025-07-23T12:41:12.048Z" }, "findingCategory": { "$ref": "#/components/schemas/FindingCategory" }, "findingDocs": { "type": "string", "description": "A URL or reference to documentation describing the finding type and remediation guidance.", "example": "Custom IaC rule for Compute Overprovisioned" }, "cspmTypeId": { "type": "number", "format": "double", "description": "The numeric type identifier of the linked CSPM rule.", "nullable": true, "example": 60100018 }, "complianceStandards": { "type": "array", "description": "The compliance standards and controls that this rule maps to.", "items": { "$ref": "#/components/schemas/ComplianceStandard" } }, "mitreTactics": { "type": "array", "description": "The MITRE ATT&CK tactics associated with the threat this rule detects.", "nullable": true, "items": { "type": "string" } }, "mitreTechniques": { "type": "array", "description": "The MITRE ATT&CK techniques associated with the threat this rule detects.", "nullable": true, "items": { "type": "string" } }, "shortDescription": { "type": "string", "description": "A brief one-line summary of what the rule detects.", "nullable": true }, "locationInDeliveryChain": { "allOf": [ { "$ref": "#/components/schemas/LocationInDeliveryChain" } ], "nullable": true, "description": "The SDLC stage where this rule applies." }, "clonedFrom": { "type": "string", "description": "The name of the original rule that this rule was cloned from, if applicable." }, "scannerRuleId": { "type": "string", "description": "The unique identifier of the rule within the scanner system." }, "clonedFromRuleId": { "type": "string", "description": "The unique identifier of the original rule that this rule was cloned from, if applicable." }, "docLink": { "type": "string", "deprecated": true, "description": "Deprecated. A URL linking to the rule's documentation. Use `findingDocs` instead.", "nullable": true } } }, "PublicUnifiedRuleResponse": { "description": "Represents a unified rule pair containing both the linked AppSec and CSPM rule objects.", "type": "object", "additionalProperties": false, "properties": { "id": { "type": "string", "description": "The primary identifier of the unified rule pair. This is always the **AppSec rule ID**. Use this value for all subsequent GET, PUT, and DELETE operations on this unified rule.", "example": "APPSEC_CUSTOM_f3b7d9a1-8c42-4e6b-b1d5-92a7c4e8f103" }, "appsec": { "$ref": "#/components/schemas/PublicDetectionRule" }, "cspm": { "$ref": "#/components/schemas/CspmRule" }, "warnings": { "type": "array", "description": "A list of non-fatal warning messages generated during the operation (for example, partial data availability from a downstream service).", "items": { "type": "string" } } } }, "PublicUnifiedRuleListResponse": { "description": "A paginated list of unified rule pairs.", "type": "object", "additionalProperties": false, "properties": { "offset": { "type": "number", "format": "double", "description": "The number of unified rules skipped before the current page of results. Reflects the `offset` value from the request.", "example": 0 }, "nextOffset": { "type": "number", "format": "double", "description": "The offset value to use in the next request to retrieve the next page of results. Returns `null` when there are no more results.", "example": 10, "nullable": true }, "items": { "type": "array", "description": "The list of unified rule pairs returned for the current page.", "items": { "$ref": "#/components/schemas/PublicUnifiedRuleResponse" } }, "warnings": { "type": "array", "description": "A list of non-fatal warning messages generated during the list operation (for example, partial data availability from a downstream service).", "items": { "type": "string" } } } }, "UnifiedRuleErrorCode": { "type": "string", "description": "A machine-readable error code indicating the specific failure that occurred during a unified rule operation.\n- `CSPM_CREATE_FAILED` — The CSPM rule creation failed. No rollback is needed.\n- `APPSEC_CREATE_FAILED` — The AppSec rule creation failed after the CSPM rule was created. An automatic rollback of the CSPM rule was attempted.\n- `APPSEC_VALIDATION_FAILED` — The AppSec rule request body failed validation. No rules were created.\n- `ROLLBACK_FAILED` — The automatic rollback of the CSPM rule failed after an AppSec creation error. The CSPM rule may be orphaned. Check `orphanedCspmRuleId` for the ID to clean up manually.\n- `ORPHANED_CSPM_RULE` — A CSPM rule exists without a linked AppSec rule.", "enum": [ "CSPM_CREATE_FAILED", "APPSEC_CREATE_FAILED", "APPSEC_VALIDATION_FAILED", "ROLLBACK_FAILED", "ORPHANED_CSPM_RULE" ] }, "UnifiedRuleErrorPayload": { "description": "The error response body returned when a unified rule operation fails.", "properties": { "error": { "type": "string", "description": "A human-readable message describing the error that occurred." }, "code": { "description": "A machine-readable error code identifying the specific failure type.", "allOf": [ { "$ref": "#/components/schemas/UnifiedRuleErrorCode" } ] }, "orphanedCspmRuleId": { "type": "string", "description": "The ID of the CSPM rule that was created but could not be rolled back. Present only when `code` is `ROLLBACK_FAILED` or `ORPHANED_CSPM_RULE`. Use this ID to manually delete the orphaned CSPM rule." }, "details": { "description": "Additional structured details about the error, if available." }, "retriable": { "type": "boolean", "description": "Indicates whether the failed operation can be safely retried. When `true`, the error is transient and retrying the request may succeed." } }, "required": [ "error", "code" ], "type": "object", "additionalProperties": false }, "ModuleResult_PublicDetectionRule_": { "description": "The per-rule result for the AppSec rule in a multi-status operation (such as a partial update or partial delete). Indicates whether the AppSec rule operation succeeded, failed, or was skipped.", "anyOf": [ { "description": "The AppSec rule operation completed successfully.", "properties": { "status": { "type": "string", "enum": [ "success" ], "nullable": false, "description": "Indicates the AppSec rule operation completed successfully." }, "rule": { "description": "The updated AppSec rule object. Present only when `status` is `success`.", "allOf": [ { "$ref": "#/components/schemas/PublicDetectionRule" } ] } }, "required": [ "status", "rule" ], "type": "object" }, { "description": "The AppSec rule operation failed.", "properties": { "status": { "type": "string", "enum": [ "failed" ], "nullable": false, "description": "Indicates the AppSec rule operation failed." }, "error": { "type": "string", "description": "A human-readable message describing why the AppSec rule operation failed." } }, "required": [ "status", "error" ], "type": "object" }, { "description": "The AppSec rule operation was skipped because no AppSec fields were included in the request.", "properties": { "status": { "type": "string", "enum": [ "skipped" ], "nullable": false, "description": "Indicates the AppSec rule operation was skipped (for example, because no AppSec fields were included in the update request)." } }, "required": [ "status" ], "type": "object" } ] }, "ModuleResult_CspmRule_": { "description": "The per-rule result for the CSPM rule in a multi-status operation (such as a partial update or partial delete). Indicates whether the CSPM rule operation succeeded, failed, or was skipped.", "anyOf": [ { "description": "The CSPM rule operation completed successfully.", "properties": { "status": { "type": "string", "enum": [ "success" ], "nullable": false, "description": "Indicates the CSPM rule operation completed successfully." }, "rule": { "description": "The updated CSPM rule object. Present only when `status` is `success`.", "allOf": [ { "$ref": "#/components/schemas/CspmRule" } ] } }, "required": [ "status", "rule" ], "type": "object" }, { "description": "The CSPM rule operation failed.", "properties": { "status": { "type": "string", "enum": [ "failed" ], "nullable": false, "description": "Indicates the CSPM rule operation failed." }, "error": { "type": "string", "description": "A human-readable message describing why the CSPM rule operation failed." } }, "required": [ "status", "error" ], "type": "object" }, { "description": "The CSPM rule operation was skipped because no CSPM fields were included in the request.", "properties": { "status": { "type": "string", "enum": [ "skipped" ], "nullable": false, "description": "Indicates the CSPM rule operation was skipped (for example, because no CSPM fields were included in the update request)." } }, "required": [ "status" ], "type": "object" } ] }, "PublicUnifiedRuleMultiStatusResponse": { "description": "The response body returned when a unified rule operation partially succeeds (HTTP 207). Contains per-rule status details for both the AppSec and CSPM rule operations.", "properties": { "id": { "type": "string", "description": "The primary identifier of the unified rule pair. This is always the AppSec rule ID.", "example": "appsec-rule-abc123" }, "appsec": { "description": "The result of the AppSec rule operation, indicating whether it succeeded, failed, or was skipped.", "allOf": [ { "$ref": "#/components/schemas/ModuleResult_PublicDetectionRule_" } ] }, "cspm": { "allOf": [ { "$ref": "#/components/schemas/ModuleResult_CspmRule_" }, { "properties": { "cspmRuleId": { "type": "string", "description": "The unique identifier of the CSPM rule involved in the operation.", "example": "cspm-rule-xyz789" } }, "type": "object" } ], "description": "The result of the CSPM rule operation, indicating whether it succeeded, failed, or was skipped." }, "warnings": { "items": { "type": "string" }, "type": "array", "description": "A list of non-fatal warning messages generated during the operation." } }, "required": [ "id", "appsec", "cspm" ], "type": "object", "additionalProperties": false }, "CreateCspmRuleParams": { "description": "The request parameters for creating a new CSPM rule as part of a unified rule pair.", "properties": { "name": { "type": "string", "description": "The display name for the new CSPM rule. Must be unique within your tenant." }, "query": { "description": "The query definition that the CSPM rule uses to evaluate cloud resources. Provide at least one query format (`rql`, `xql`, or `json`).", "allOf": [ { "$ref": "#/components/schemas/CspmQuery" } ] }, "severity": { "type": "string", "description": "The priority level for findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`." }, "description": { "type": "string", "description": "A human-readable explanation of what the CSPM rule checks and why it matters." }, "type": { "type": "string", "description": "The rule type classification (for example, `Config`, `Network`)." }, "class": { "type": "string", "description": "The rule class used for internal categorization." }, "assetTypes": { "items": { "type": "string" }, "type": "array", "description": "The list of cloud asset types that this CSPM rule evaluates (for example, `aws_s3_bucket`)." }, "metadata": { "description": "Additional key-value metadata to associate with the CSPM rule.", "allOf": [ { "$ref": "#/components/schemas/Record_string.unknown_" } ] }, "complianceMetadata": { "anyOf": [ { "$ref": "#/components/schemas/Record_string.unknown_" }, { "items": { "$ref": "#/components/schemas/Record_string.unknown_" }, "type": "array" } ], "description": "Compliance framework metadata to associate with the CSPM rule, such as control IDs and standard names. Accepts either a single object or an array of objects." }, "labels": { "items": { "type": "string" }, "type": "array", "description": "User-defined labels to assign to the CSPM rule for organization and filtering." }, "enabled": { "type": "boolean", "description": "Whether the CSPM rule should be active immediately after creation. Defaults to `true`." } }, "required": [ "name", "query", "severity" ], "type": "object", "additionalProperties": false }, "CreateAppsecRuleParams": { "description": "The request parameters for creating the AppSec rule portion of a unified rule pair. The `cspmRuleId`, `cspmTypeId`, and `shouldConnectToCspm` fields are managed automatically by the unified rule endpoint and must not be included in the request.", "properties": { "name": { "type": "string", "description": "The display name for the new AppSec rule. Must be unique within your tenant." }, "severity": { "description": "The priority level for findings detected by this AppSec rule.", "allOf": [ { "$ref": "#/components/schemas/Severity" } ] }, "scanner": { "description": "The scanner type for this custom rule. Only `IAC` and `SECRETS` are supported for custom rule creation.", "allOf": [ { "$ref": "#/components/schemas/CustomRuleScanner" } ] }, "frameworks": { "items": { "$ref": "#/components/schemas/FrameworkRequestParams" }, "type": "array", "description": "The list of IaC frameworks or languages this rule applies to, along with their detection definitions. At least one framework is required." }, "category": { "description": "The security category for this rule. Use `CustomRuleIacCategory` values for `IAC` rules and `CustomRuleSecretsCategory` values for `SECRETS` rules.", "allOf": [ { "$ref": "#/components/schemas/CustomRuleCategory" } ] }, "subCategory": { "description": "The subcategory that further classifies the security issue. Applicable to `IAC` rules only.", "allOf": [ { "$ref": "#/components/schemas/CustomRuleIacSubCategory" } ] }, "description": { "type": "string", "description": "A human-readable explanation of what the rule detects and why it matters." }, "labels": { "items": { "type": "string" }, "type": "array", "description": "User-defined labels to assign to the rule for organization and filtering." }, "clonedFromRuleId": { "type": "string", "description": "The unique identifier of the rule this rule was cloned from, if applicable." } }, "required": [ "name", "severity", "scanner", "frameworks", "category" ], "type": "object", "additionalProperties": false }, "CreateUnifiedRuleRequest": { "description": "The request body for creating a unified rule pair. Both the `cspm` and `appsec` rule definitions are required.\n\nThe endpoint creates the CSPM rule first, then creates the AppSec rule with the CSPM rule ID automatically injected to link the two rules. If the AppSec rule creation fails, the CSPM rule is automatically rolled back.", "properties": { "cspm": { "description": "The definition for the CSPM rule to create. This rule evaluates deployed cloud infrastructure at runtime.", "allOf": [ { "$ref": "#/components/schemas/CreateCspmRuleParams" } ] }, "appsec": { "description": "The definition for the AppSec IaC rule to create. This rule evaluates IaC configurations in code repositories. The CSPM rule ID is automatically injected to link the two rules.", "allOf": [ { "$ref": "#/components/schemas/CreateAppsecRuleParams" } ] } }, "required": [ "cspm", "appsec" ], "type": "object", "additionalProperties": false }, "Partial_CspmRule_": { "description": "A partial update object for a CSPM rule. All fields are optional. Include only the fields you want to update.", "properties": { "id": { "type": "string", "description": "Unique identifier of the CSPM rule. Read-only in update requests." }, "type": { "type": "string", "description": "The type classification of the CSPM rule." }, "name": { "type": "string", "description": "The updated display name for the CSPM rule." }, "severity": { "type": "string", "description": "The updated priority level for findings detected by this CSPM rule. Accepted values: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`." }, "owner": { "type": "string", "description": "The updated owner of the CSPM rule." }, "description": { "type": "string", "description": "The updated human-readable explanation of what the CSPM rule checks." }, "enabled": { "type": "boolean", "description": "Whether the CSPM rule should be active. Set to `true` to enable or `false` to disable." }, "deleted": { "type": "boolean", "description": "Whether the CSPM rule should be soft-deleted." }, "systemDefault": { "type": "boolean", "description": "Indicates whether this is a system-provided rule. Read-only in update requests." }, "assetTypes": { "items": { "type": "string" }, "type": "array", "description": "The updated list of cloud asset types that this CSPM rule evaluates." }, "providers": { "items": { "type": "string" }, "type": "array", "description": "The updated list of cloud providers associated with this CSPM rule." }, "labels": { "items": { "type": "string" }, "type": "array", "description": "The updated list of user-defined labels for the CSPM rule." }, "complianceMetadata": { "items": { "$ref": "#/components/schemas/Record_string.unknown_" }, "type": "array", "description": "The updated compliance framework metadata for the CSPM rule." }, "metadata": { "description": "The updated key-value metadata for the CSPM rule.", "allOf": [ { "$ref": "#/components/schemas/Record_string.unknown_" } ] }, "query": { "description": "The updated query definition for the CSPM rule.", "allOf": [ { "$ref": "#/components/schemas/Record_string.unknown_" } ] }, "version": { "type": "string", "description": "The updated version identifier of the CSPM rule definition." }, "lastModifiedBy": { "type": "string", "description": "The username of the user who last modified this CSPM rule. Read-only in update requests." } } }, "Partial_Omit_ModifyRuleParams.cspmRuleId__": { "description": "A partial update object for an AppSec rule in a unified rule pair. Currently supports updating labels only.", "properties": { "labels": { "items": { "type": "string" }, "type": "array", "description": "The updated list of user-defined labels for the AppSec rule." } } }, "UpdateUnifiedRuleRequest": { "description": "The request body for updating a unified rule pair. Include only the rule object or fields you want to update. You can update the CSPM rule, the AppSec rule, or both in a single request.", "properties": { "cspm": { "description": "The fields to update on the CSPM rule. Include only the fields you want to change.", "allOf": [ { "$ref": "#/components/schemas/Partial_CspmRule_" } ] }, "appsec": { "description": "The fields to update on the AppSec rule. Include only the fields you want to change.", "allOf": [ { "$ref": "#/components/schemas/Partial_Omit_ModifyRuleParams.cspmRuleId__" } ] } }, "type": "object", "additionalProperties": false } }, "securitySchemes": {} } }