canonical: https://jentic.com/apis/paloaltonetworks.com/prisma-cloud-cspm

# Paloaltonetworks Prisma Cloud CSPM API

Jentic publishes the only available OpenAPI specification for Prisma Cloud CSPM API, keeping it validated and agent-ready. Monitor and enforce cloud security posture across AWS, Azure, and GCP environments through 91 endpoints covering alert management, compliance reporting, policy configuration, asset inventory, and cloud account onboarding. The API provides programmatic access to Prisma Cloud's risk scoring, compliance framework mapping (CIS, NIST, SOC 2, PCI-DSS), and multi-cloud asset visibility with bearer token authentication across three regional deployments.

## For AI agents

Query cloud security alerts, check compliance posture, manage security policies, and inventory multi-cloud assets across AWS, Azure, and GCP through Palo Alto Networks' Prisma Cloud CSPM platform.

## Scope

Does not handle endpoint protection, network firewall rules, or application-layer security - use for cloud infrastructure posture management and compliance monitoring only.

## Capabilities

- Query and dismiss cloud security alerts filtered by severity, policy type, and cloud account
- Run compliance posture checks against CIS, NIST, SOC 2, and PCI-DSS frameworks with pass/fail breakdowns
- Onboard and manage cloud accounts from AWS, Azure, and GCP with status monitoring
- Search cloud assets by resource type, region, and compliance violation status
- Configure alert rules that trigger notifications to integrations like Slack, email, and SIEM
- Define and assign user roles with fine-grained access controls and account group scoping
- Retrieve audit logs tracking all administrative actions and policy changes

## Use cases

### AI Agent Cloud Compliance Monitoring

An AI agent uses the Prisma Cloud CSPM API through Jentic to continuously monitor multi-cloud compliance posture, querying compliance endpoints to retrieve pass/fail scores against CIS, NIST, and PCI-DSS frameworks. The agent identifies drifting resources, retrieves specific alert details, and can trigger remediation actions - all without manually configuring bearer token refresh or discovering the correct regional API endpoint.

Example prompt: Retrieve the compliance posture via GET /compliance/posture for the CIS framework, then list failing resources using GET /alert filtered by policy.complianceMetadata.standardName

### Multi-Cloud Alert Triage

Triage cloud security alerts across AWS, Azure, and GCP environments by querying Prisma Cloud's unified alert system. The API aggregates misconfiguration findings, anomalous activity detections, and policy violations into a single interface with filtering by severity, cloud type, account group, and policy category. Security teams reduce alert fatigue by programmatically dismissing resolved findings and focusing on critical risks.

Example prompt: Query GET /alert for high-severity alerts in the last 24 hours, retrieve detailed findings for the top 5 via GET /alert/{id}, and dismiss resolved ones via POST /alert/dismiss

### Cloud Account Onboarding and Monitoring

Onboard new cloud accounts from AWS, Azure, or GCP into Prisma Cloud for continuous security monitoring. The API handles cloud account registration, validates connectivity and permissions, monitors onboarding status, and assigns accounts to account groups for policy inheritance. Automated onboarding reduces time-to-protection from days to minutes for new cloud subscriptions added to the organization.

Example prompt: Onboard an AWS account via POST /cloud/aws with the account ID and role ARN, then check status via GET /cloud/aws/{id}/status

### Asset Inventory and Risk Assessment

Query the complete inventory of cloud assets across all onboarded accounts with filtering by resource type, region, and compliance violation status. The search API enables discovery of misconfigured resources like public S3 buckets, overly permissive security groups, and unencrypted databases. Asset data includes configuration details, compliance mappings, and risk scores for prioritized remediation.

Example prompt: Search for all public S3 buckets using POST /search with a RQL query filtering by cloud.type='aws' and resource.type='aws_s3_bucket' with publicAccessBlockConfiguration violations

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /alert | List cloud security alerts with filtering |
| GET | /alert/{id} | Retrieve detailed alert information by ID |
| POST | /alert/dismiss | Dismiss resolved alerts with reason |
| GET | /compliance/posture | Get compliance posture summary across frameworks |
| GET | /compliance/posture/{complianceId} | Retrieve posture for a specific compliance standard |
| POST | /cloud/{cloudType} | Onboard a new cloud account |
| GET | /cloud/{cloudType}/{id}/status | Check cloud account onboarding status |
| GET | /audit_logs | Retrieve administrative audit log events |

## Key resources

- **Alerts** — Query, dismiss, reopen, and remediate cloud security alerts with severity and policy filtering
- **Compliance** — Retrieve compliance posture scores against CIS, NIST, SOC 2, and PCI-DSS frameworks
- **Cloud Accounts** — Onboard, monitor, and manage AWS, Azure, and GCP accounts
- **Policies** — Configure and manage security policies with auto-remediation options
- **Assets** — Search and inventory cloud resources with configuration and compliance metadata
- **Alert Rules** — Define notification rules that route alerts to integrations based on severity and policy type

## Why Jentic

- **Setup:** Wiring Prisma Cloud by hand means learning its bearer-token auth, selecting the correct regional stack among the API, api2 through api4, and api.eu.prismacloud.io hosts, and building your own retry and error handling. Through Jentic you install once, import the Prisma Cloud CSPM API from the API Directory, store the access key once, and your agent calls it.
- **Permission scoping:** Prisma Cloud puts resource ids in the URL path (/alert/{id} and /cloud/{cloudType}/{id}/status), and you choose which operations the agent may call. Limit it to what it needs, such as reading alerts and compliance posture, so operations like dismissing alerts or adding a cloud account are not included unless you add them.
- **Credential handling:** Your Prisma Cloud access key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'check cloud compliance posture' or 'list open alerts', and Jentic returns the matching Prisma Cloud operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Cortex XSOAR API** — Security orchestration platform that can automate response to Prisma Cloud alerts
- **CrowdStrike Falcon API** — Endpoint protection complementing Prisma Cloud's cloud infrastructure security
- **Tenable Vulnerability Management API** — Vulnerability scanning for infrastructure that complements cloud posture management

## FAQ

### Why is there no official OpenAPI spec for Prisma Cloud CSPM API?

Palo Alto Networks does not publish an OpenAPI specification for Prisma Cloud CSPM. Jentic generates and maintains this spec so that AI agents and developers can call Prisma Cloud CSPM API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the Prisma Cloud CSPM API use?

The Prisma Cloud CSPM API uses bearer token authentication. You authenticate via POST /login with your access key and secret key to receive a JWT token valid for 10 minutes, extendable via POST /auth_token/extend. Through Jentic, credentials are stored encrypted in your Jentic One instance with automatic token refresh.

### Can I check compliance posture against specific frameworks with the Prisma Cloud API?

Yes. Use GET /compliance/posture for an overview across all frameworks, or GET /compliance/posture/{complianceId} for a specific standard like CIS AWS Foundations Benchmark. The response includes pass/fail counts per section, overall compliance percentage, and a list of failing resources with policy details.

### What are the rate limits for the Prisma Cloud CSPM API?

Prisma Cloud enforces rate limits that vary by endpoint and tenant tier. Alert and compliance queries allow several hundred requests per minute. The API returns 429 status codes when limits are exceeded. Bearer tokens expire after 10 minutes, requiring refresh via the auth_token/extend endpoint.

### How do I triage cloud security alerts through Jentic?

Search Jentic for 'triage cloud security alerts', which returns the GET /alert and POST /alert/dismiss operations. Query alerts filtered by severity and cloud account, review detailed findings, and dismiss resolved ones with a documented reason. Install with pip install jentic and authenticate through Jentic One, the self-hosted execution layer.

### Which cloud providers does the Prisma Cloud CSPM API support?

The API supports AWS, Azure, and GCP cloud accounts. Onboard each provider via POST /cloud/{cloudType} where cloudType is 'aws', 'azure', or 'gcp'. Each provider requires specific connection parameters - AWS uses a cross-account role ARN, Azure uses a service principal, and GCP uses a service account key.

### Can I search for specific misconfigured cloud resources?

Yes. The POST /search endpoint accepts Resource Query Language (RQL) queries to find specific resource types with compliance violations. For example, you can query for all S3 buckets without encryption enabled, all security groups with unrestricted inbound rules, or all databases without backup configured.

### Can I limit what my agent is allowed to do with the Prisma Cloud CSPM API?

Yes. Because Jentic One is self-hosted, you decide which Prisma Cloud operations your agent may call, and your own rules govern that scope. You can restrict it to read-only work such as listing alerts with GET /alert and checking compliance posture with GET /compliance/posture, so that write operations like dismissing alerts via POST /alert/dismiss or onboarding a cloud account via POST /cloud/{cloudType} are excluded unless you explicitly add them. The access key stays in your Jentic One instance and is injected at execution time, so the agent only ever exercises the operations and credentials you allow.