Prisma Cloud CSPM API

Name: Prisma Cloud CSPM API API
Brand: Prisma Cloud CSPM API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityCompliancebearer91 EndpointsREST

For Agents

Query cloud security alerts, check compliance posture, manage security policies, and inventory multi-cloud assets across AWS, Azure, and GCP through Palo Alto Networks' Prisma Cloud CSPM platform.

Connect the Prisma Cloud CSPM API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Prisma Cloud CSPM API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Prisma Cloud CSPM API API.

Query and dismiss cloud security alerts filtered by severity, policy type, and cloud account

Run compliance posture checks against CIS, NIST, SOC 2, and PCI-DSS frameworks with pass/fail breakdowns

Onboard and manage cloud accounts from AWS, Azure, and GCP with status monitoring

Search cloud assets by resource type, region, and compliance violation status

GET STARTED

Start building with Prisma Cloud CSPM API API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for Prisma Cloud CSPM API, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for Prisma Cloud CSPM API, keeping it validated and agent-ready. Monitor and enforce cloud security posture across AWS, Azure, and GCP environments through 91 endpoints covering alert management, compliance reporting, policy configuration, asset inventory, and cloud account onboarding. The API provides programmatic access to Prisma Cloud's risk scoring, compliance framework mapping (CIS, NIST, SOC 2, PCI-DSS), and multi-cloud asset visibility with bearer token authentication across three regional deployments.

Use Cases

Patterns agents use Prisma Cloud CSPM API API for, with concrete tasks.

★ AI Agent Cloud Compliance Monitoring

An AI agent uses the Prisma Cloud CSPM API through Jentic to continuously monitor multi-cloud compliance posture, querying compliance endpoints to retrieve pass/fail scores against CIS, NIST, and PCI-DSS frameworks. The agent identifies drifting resources, retrieves specific alert details, and can trigger remediation actions — all without manually configuring bearer token refresh or discovering the correct regional API endpoint.

Retrieve the compliance posture via GET /compliance/posture for the CIS framework, then list failing resources using GET /alert filtered by policy.complianceMetadata.standardName

Multi-Cloud Alert Triage

Triage cloud security alerts across AWS, Azure, and GCP environments by querying Prisma Cloud's unified alert system. The API aggregates misconfiguration findings, anomalous activity detections, and policy violations into a single interface with filtering by severity, cloud type, account group, and policy category. Security teams reduce alert fatigue by programmatically dismissing resolved findings and focusing on critical risks.

Query GET /alert for high-severity alerts in the last 24 hours, retrieve detailed findings for the top 5 via GET /alert/{id}, and dismiss resolved ones via POST /alert/dismiss

Cloud Account Onboarding and Monitoring

Onboard new cloud accounts from AWS, Azure, or GCP into Prisma Cloud for continuous security monitoring. The API handles cloud account registration, validates connectivity and permissions, monitors onboarding status, and assigns accounts to account groups for policy inheritance. Automated onboarding reduces time-to-protection from days to minutes for new cloud subscriptions added to the organization.

Onboard an AWS account via POST /cloud/aws with the account ID and role ARN, then check status via GET /cloud/aws/{id}/status

Asset Inventory and Risk Assessment

Query the complete inventory of cloud assets across all onboarded accounts with filtering by resource type, region, and compliance violation status. The search API enables discovery of misconfigured resources like public S3 buckets, overly permissive security groups, and unencrypted databases. Asset data includes configuration details, compliance mappings, and risk scores for prioritized remediation.

Search for all public S3 buckets using POST /search with a RQL query filtering by cloud.type='aws' and resource.type='aws_s3_bucket' with publicAccessBlockConfiguration violations

Key Endpoints

91 endpoints — jentic publishes the only available openapi specification for prisma cloud cspm api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/alert

List cloud security alerts with filtering

GET

/alert/{id}

Retrieve detailed alert information by ID

POST

/alert/dismiss

Dismiss resolved alerts with reason

GET

/compliance/posture

Get compliance posture summary across frameworks

GET

/compliance/posture/{complianceId}

Retrieve posture for a specific compliance standard

POST

/cloud/{cloudType}

Onboard a new cloud account

GET

/cloud/{cloudType}/{id}/status

Check cloud account onboarding status

GET

/audit_logs

Retrieve administrative audit log events

GET

/alert

List cloud security alerts with filtering

GET

/alert/{id}

Retrieve detailed alert information by ID

POST

/alert/dismiss

Dismiss resolved alerts with reason

GET

/compliance/posture

Get compliance posture summary across frameworks

GET

/compliance/posture/{complianceId}

Retrieve posture for a specific compliance standard

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Prisma Cloud access keys are stored encrypted in the Jentic vault (MAXsystem). Agents receive scoped bearer tokens with automatic refresh — raw access keys and secret keys never enter the agent's context window.

Intent-based discovery

Agents search by intent (e.g., 'check cloud compliance posture') and Jentic returns matching Prisma Cloud operations with their input schemas, so the agent can call the right endpoint without navigating Palo Alto Networks documentation or determining the correct regional stack.

Time to first call

Direct Prisma Cloud integration: 2-4 days for auth flow, regional endpoint selection, and RQL query formatting. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Cortex XSOAR API

Security orchestration platform that can automate response to Prisma Cloud alerts

Choose Cortex XSOAR when you need to build automated response playbooks triggered by Prisma Cloud findings rather than querying posture directly

Complementary

CrowdStrike Falcon API

Endpoint protection complementing Prisma Cloud's cloud infrastructure security

Choose CrowdStrike when the task involves endpoint threat detection and host containment rather than cloud resource misconfiguration

Complementary

Tenable Vulnerability Management API

Vulnerability scanning for infrastructure that complements cloud posture management

Choose Tenable when you need network vulnerability scanning and host-level assessment rather than cloud-native misconfiguration detection

FAQs

Specific to using Prisma Cloud CSPM API API through Jentic.

Why is there no official OpenAPI spec for Prisma Cloud CSPM API?

Palo Alto Networks does not publish an OpenAPI specification for Prisma Cloud CSPM. Jentic generates and maintains this spec so that AI agents and developers can call Prisma Cloud CSPM API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Prisma Cloud CSPM API use?

The Prisma Cloud CSPM API uses bearer token authentication. You authenticate via POST /login with your access key and secret key to receive a JWT token valid for 10 minutes, extendable via POST /auth_token/extend. Through Jentic, credentials are stored encrypted in the MAXsystem vault with automatic token refresh.

Can I check compliance posture against specific frameworks with the Prisma Cloud API?

Yes. Use GET /compliance/posture for an overview across all frameworks, or GET /compliance/posture/{complianceId} for a specific standard like CIS AWS Foundations Benchmark. The response includes pass/fail counts per section, overall compliance percentage, and a list of failing resources with policy details.

What are the rate limits for the Prisma Cloud CSPM API?

Prisma Cloud enforces rate limits that vary by endpoint and tenant tier. Alert and compliance queries allow several hundred requests per minute. The API returns 429 status codes when limits are exceeded. Bearer tokens expire after 10 minutes, requiring refresh via the auth_token/extend endpoint.

How do I triage cloud security alerts through Jentic?

Search Jentic for 'triage cloud security alerts', which returns the GET /alert and POST /alert/dismiss operations. Query alerts filtered by severity and cloud account, review detailed findings, and dismiss resolved ones with a documented reason. Install with pip install jentic and authenticate at https://app.jentic.com/sign-up.

Which cloud providers does the Prisma Cloud CSPM API support?

The API supports AWS, Azure, and GCP cloud accounts. Onboard each provider via POST /cloud/{cloudType} where cloudType is 'aws', 'azure', or 'gcp'. Each provider requires specific connection parameters — AWS uses a cross-account role ARN, Azure uses a service principal, and GCP uses a service account key.

Can I search for specific misconfigured cloud resources?

Yes. The POST /search endpoint accepts Resource Query Language (RQL) queries to find specific resource types with compliance violations. For example, you can query for all S3 buckets without encryption enabled, all security groups with unrestricted inbound rules, or all databases without backup configured.