SaaS Security Posture Management API

openapi: 3.1.0
info:
  title: Palo Alto Networks SaaS Security Posture Management API
  description: >-
    SaaS Security Posture Management (SSPM) API for assessing and improving
    the security posture of connected SaaS applications. Enables onboarding
    of SaaS applications, retrieval of posture check results, management of
    remediation status, browsing the SaaS application catalog, and
    configuration of Jira integrations for ticketing workflows. Part of the
    Palo Alto Networks SASE platform.
  version: '1.0'
  contact:
    name: Palo Alto Networks Developer Support
    url: https://pan.dev/
  license:
    name: Proprietary
    url: https://www.paloaltonetworks.com/legal
servers:
- url: https://api.sase.paloaltonetworks.com/sspm
  description: SASE SSPM API production server.
security:
- oauth2Bearer: []
tags:
- name: App Catalog
  description: SaaS application catalog and metadata.
- name: Apps
  description: SaaS application onboarding and management.
- name: Integrations
  description: Third-party integrations including Jira ticketing.
- name: Posture Checks
  description: Security posture check results and remediation status.
paths:
  /v1/apps:
    get:
      operationId: listOnboardedApps
      summary: Palo Alto Networks List Onboarded SaaS Applications
      description: >-
        Returns the list of SaaS applications that have been onboarded to
        SSPM for posture assessment. Each entry includes the application
        type, connection status, and summary counts of posture check results
        by severity.
      tags:
      - Apps
      parameters:
      - name: status
        in: query
        description: Filter applications by connection status.
        schema:
          type: string
          enum:
          - connected
          - disconnected
          - pending
          - error
        example: disconnected
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of applications to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Onboarded applications returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/OnboardedApp'
              examples:
                ListOnboardedApps200Example:
                  summary: Default listOnboardedApps 200 response
                  x-microcks-default: true
                  value:
                    total: 694
                    offset: 752
                    limit: 416
                    items:
                    - app_id: '621838'
                      app_type: standard
                      display_name: Sarah Doe
                      status: error
                      tenant_id: tenant-34be8834
                      check_summary: &id001
                        critical: 904
                        high: 463
                        medium: 193
                        low: 762
                        pass: 336
                      last_scanned_at: '2026-06-23T07:17:30Z'
                      onboarded_at: '2026-07-05T03:34:39Z'
                    - app_id: '621838'
                      app_type: standard
                      display_name: Sarah Doe
                      status: error
                      tenant_id: tenant-34be8834
                      check_summary: *id001
                      last_scanned_at: '2026-06-23T07:17:30Z'
                      onboarded_at: '2026-07-05T03:34:39Z'
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListOnboardedApps400Example:
                  summary: Default listOnboardedApps 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListOnboardedApps401Example:
                  summary: Default listOnboardedApps 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListOnboardedApps403Example:
                  summary: Default listOnboardedApps 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListOnboardedApps500Example:
                  summary: Default listOnboardedApps 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
    post:
      operationId: onboardApp
      summary: Palo Alto Networks Onboard New Application
      description: >-
        Onboards a new SaaS application to SSPM for posture assessment.
        Requires specifying the application type and providing the OAuth
        consent or API credentials needed to connect to the application.
        After onboarding, SSPM performs an initial posture scan.
      tags:
      - Apps
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OnboardAppRequest'
            examples:
              OnboardAppRequestExample:
                summary: Default onboardApp request
                x-microcks-default: true
                value:
                  app_type: standard
                  display_name: Alex Garcia
                  credentials: &id004 {}
      responses:
        '201':
          description: Application onboarded successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OnboardedApp'
              examples:
                OnboardApp201Example:
                  summary: Default onboardApp 201 response
                  x-microcks-default: true
                  value:
                    app_id: '621838'
                    app_type: standard
                    display_name: Sarah Doe
                    status: error
                    tenant_id: tenant-34be8834
                    check_summary: *id001
                    last_scanned_at: '2026-06-23T07:17:30Z'
                    onboarded_at: '2026-07-05T03:34:39Z'
        '400':
          description: Invalid request body or unsupported application type.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp400Example:
                  summary: Default onboardApp 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp401Example:
                  summary: Default onboardApp 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp403Example:
                  summary: Default onboardApp 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '409':
          description: Application of this type is already onboarded.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp409Example:
                  summary: Default onboardApp 409 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                OnboardApp500Example:
                  summary: Default onboardApp 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v1/apps/{app_id}:
    delete:
      operationId: removeApp
      summary: Palo Alto Networks Remove Onboarded Application
      description: >-
        Removes a previously onboarded SaaS application from SSPM. This
        stops posture scanning for the application and removes all associated
        check results. This action cannot be undone.
      tags:
      - Apps
      parameters:
      - name: app_id
        in: path
        required: true
        description: Unique identifier of the onboarded application.
        schema:
          type: string
        example: '293827'
      responses:
        '204':
          description: Application removed successfully.
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RemoveApp401Example:
                  summary: Default removeApp 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RemoveApp403Example:
                  summary: Default removeApp 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '404':
          description: Application not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RemoveApp404Example:
                  summary: Default removeApp 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                RemoveApp500Example:
                  summary: Default removeApp 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v1/posture-checks:
    get:
      operationId: listPostureChecks
      summary: Palo Alto Networks List Posture Check Results
      description: >-
        Returns posture check results across all onboarded SaaS applications.
        Supports filtering by application, check type, severity, and
        remediation status. Each check result indicates whether a specific
        security best practice is implemented in the connected application.
      tags:
      - Posture Checks
      parameters:
      - name: app_id
        in: query
        description: Filter checks by onboarded application ID.
        schema:
          type: string
        example: '131412'
      - name: check_type
        in: query
        description: Filter by check category type.
        schema:
          type: string
          enum:
          - access_control
          - authentication
          - data_protection
          - logging
          - network_security
          - configuration
        example: logging
      - name: severity
        in: query
        description: Filter by check severity level.
        schema:
          type: string
          enum:
          - informational
          - low
          - medium
          - high
          - critical
        example: critical
      - name: status
        in: query
        description: Filter by remediation status.
        schema:
          type: string
          enum:
          - pass
          - fail
          - error
          - suppressed
        example: fail
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of check results to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Posture check results returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  offset:
                    type: integer
                  limit:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/PostureCheck'
              examples:
                ListPostureChecks200Example:
                  summary: Default listPostureChecks 200 response
                  x-microcks-default: true
                  value:
                    total: 887
                    offset: 835
                    limit: 673
                    items:
                    - check_id: '841281'
                      app_id: '849318'
                      check_name: Primary Policy 44
                      check_type: authentication
                      severity: low
                      status: suppressed
                      description: Configured network on activity configured incident alert monitoring.
                      remediation: example-remediation
                      compliance_frameworks: &id002
                      - example-compliance_frameworks_item
                      last_evaluated_at: '2026-09-01T23:02:10Z'
                      suppression_justification: example-suppression_justification
                    - check_id: '841281'
                      app_id: '849318'
                      check_name: Primary Policy 44
                      check_type: authentication
                      severity: low
                      status: suppressed
                      description: Configured network on activity configured incident alert monitoring.
                      remediation: example-remediation
                      compliance_frameworks: *id002
                      last_evaluated_at: '2026-09-01T23:02:10Z'
                      suppression_justification: example-suppression_justification
        '400':
          description: Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListPostureChecks400Example:
                  summary: Default listPostureChecks 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListPostureChecks401Example:
                  summary: Default listPostureChecks 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListPostureChecks403Example:
                  summary: Default listPostureChecks 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                ListPostureChecks500Example:
                  summary: Default listPostureChecks 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v1/posture-checks/{check_id}:
    get:
      operationId: getPostureCheck
      summary: Palo Alto Networks Get Posture Check Details
      description: >-
        Returns full details for a specific posture check result including
        the check description, affected configuration, remediation guidance,
        and compliance framework mappings.
      tags:
      - Posture Checks
      parameters:
      - name: check_id
        in: path
        required: true
        description: Unique identifier of the posture check result.
        schema:
          type: string
        example: '461435'
      responses:
        '200':
          description: Posture check details returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCheck'
              examples:
                GetPostureCheck200Example:
                  summary: Default getPostureCheck 200 response
                  x-microcks-default: true
                  value:
                    check_id: '841281'
                    app_id: '849318'
                    check_name: Primary Policy 44
                    check_type: authentication
                    severity: low
                    status: suppressed
                    description: Configured network on activity configured incident alert monitoring.
                    remediation: example-remediation
                    compliance_frameworks: *id002
                    last_evaluated_at: '2026-09-01T23:02:10Z'
                    suppression_justification: example-suppression_justification
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetPostureCheck401Example:
                  summary: Default getPostureCheck 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetPostureCheck403Example:
                  summary: Default getPostureCheck 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '404':
          description: Posture check not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetPostureCheck404Example:
                  summary: Default getPostureCheck 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                GetPostureCheck500Example:
                  summary: Default getPostureCheck 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v1/posture-checks/{check_id}/status:
    put:
      operationId: updatePostureCheckStatus
      summary: Palo Alto Networks Update Posture Check Status
      description: >-
        Updates the remediation status of a posture check result. Use this
        endpoint to mark checks as suppressed with a justification, or to
        mark remediated checks for re-evaluation.
      tags:
      - Posture Checks
      parameters:
      - name: check_id
        in: path
        required: true
        description: Unique identifier of the posture check result.
        schema:
          type: string
        example: '258568'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - status
              properties:
                status:
                  type: string
                  enum:
                  - suppressed
                  - pending_remediation
                  description: New status to set for the check.
                justification:
                  type: string
                  description: >-
                    Reason for suppressing the check. Required when setting
                    status to suppressed.
                  maxLength: 1024
            examples:
              UpdatePostureCheckStatusRequestExample:
                summary: Default updatePostureCheckStatus request
                x-microcks-default: true
                value:
                  status: pending_remediation
                  justification: example-justification
      responses:
        '200':
          description: Check status updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostureCheck'
              examples:
                UpdatePostureCheckStatus200Example:
                  summary: Default updatePostureCheckStatus 200 response
                  x-microcks-default: true
                  value:
                    check_id: '841281'
                    app_id: '849318'
                    check_name: Primary Policy 44
                    check_type: authentication
                    severity: low
                    status: suppressed
                    description: Configured network on activity configured incident alert monitoring.
                    remediation: example-remediation
                    compliance_frameworks: *id002
                    last_evaluated_at: '2026-09-01T23:02:10Z'
                    suppression_justification: example-suppression_justification
        '400':
          description: Invalid request body.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdatePostureCheckStatus400Example:
                  summary: Default updatePostureCheckStatus 400 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '401':
          description: Invalid or missing Bearer token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdatePostureCheckStatus401Example:
                  summary: Default updatePostureCheckStatus 401 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '403':
          description: Insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdatePostureCheckStatus403Example:
                  summary: Default updatePostureCheckStatus 403 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '404':
          description: Posture check not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdatePostureCheckStatus404Example:
                  summary: Default updatePostureCheckStatus 404 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              examples:
                UpdatePostureCheckStatus500Example:
                  summary: Default updatePostureCheckStatus 500 response
                  x-microcks-default: true
                  value:
                    error: example-error
                    message: Malware violation rule blocked detected endpoint policy detected.
                    request_id: f7942ddd-4571-4f6e-a8a1-00c0f9d7dfb4
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /v1/app-catalog:
    get:
      operationId: listAppCatalog
      summary: Palo Alto Networks List SaaS Application Catalog
      description: >-
        Returns the catalog of SaaS applications supported for SSPM posture
        assessment. Each entry describes the application, the number of
        available posture checks, and supported compliance frameworks.
      tags:
      - App Catalog
      parameters:
      - name: category
        in: query
        description: Filter by application category.
        schema:
          type: string
        example: advanced
      - name: offset
        in: query
        description: Number of results to skip for pagination.
        schema:
          type: integer
          default: 0
        example: 0
      - name: limit
        in: query
        description: Maximum number of catalog entries to return.
        schema:
          type: integer
          default: 50
          maximum: 200
        example: 50
      responses:
        '200':
          description: Application catalog returned.
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/CatalogApp'
              examples:
                ListAppCatalog200Example:
                  summary: Default listAppCatalog 200 response
                  x-microcks-default: true
                  value:
                    total: 731
                    items:
                    - app_type: standard
                      display_name: John Wilson
                      category: custom
                      check_count: 923
                      compliance_frameworks: &id003
                      - example-compliance_frameworks_item
                      - example-compliance_frameworks_item
     

# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/palo-alto-networks/refs/heads/main/openapi/palo-alto-sspm-api-openapi-original.yml