Paloaltonetworks Prisma Cloud CSPM API
Browse all Paloaltonetworks APIs★ Only Publicly Available OpenAPI DocumentSecurityCompliancebearer91 EndpointsREST
For Agents
Query cloud security alerts, check compliance posture, manage security policies, and inventory multi-cloud assets across AWS, Azure, and GCP through Palo Alto Networks' Prisma Cloud CSPM platform.
Use for: I need to check the compliance posture of my AWS accounts against CIS benchmarks, List all open high-severity cloud security alerts from the last week, Dismiss a resolved alert and document the remediation reason, Find all S3 buckets that violate public access policies
Not supported: Does not handle endpoint protection, network firewall rules, or application-layer security — use for cloud infrastructure posture management and compliance monitoring only.
Jentic publishes the only available OpenAPI specification for Prisma Cloud CSPM API, keeping it validated and agent-ready. Monitor and enforce cloud security posture across AWS, Azure, and GCP environments through 91 endpoints covering alert management, compliance reporting, policy configuration, asset inventory, and cloud account onboarding. The API provides programmatic access to Prisma Cloud's risk scoring, compliance framework mapping (CIS, NIST, SOC 2, PCI-DSS), and multi-cloud asset visibility with bearer token authentication across three regional deployments.
Install Jentic One Beta
Connect the Prisma Cloud CSPM API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Prisma Cloud CSPM API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Prisma Cloud CSPM API.
Query and dismiss cloud security alerts filtered by severity, policy type, and cloud account
Run compliance posture checks against CIS, NIST, SOC 2, and PCI-DSS frameworks with pass/fail breakdowns
Onboard and manage cloud accounts from AWS, Azure, and GCP with status monitoring
Search cloud assets by resource type, region, and compliance violation status
Configure alert rules that trigger notifications to integrations like Slack, email, and SIEM
Define and assign user roles with fine-grained access controls and account group scoping
Retrieve audit logs tracking all administrative actions and policy changes
Use Cases
Patterns agents use Prisma Cloud CSPM API for, with concrete tasks.
★ AI Agent Cloud Compliance Monitoring
An AI agent uses the Prisma Cloud CSPM API through Jentic to continuously monitor multi-cloud compliance posture, querying compliance endpoints to retrieve pass/fail scores against CIS, NIST, and PCI-DSS frameworks. The agent identifies drifting resources, retrieves specific alert details, and can trigger remediation actions — all without manually configuring bearer token refresh or discovering the correct regional API endpoint.
Retrieve the compliance posture via GET /compliance/posture for the CIS framework, then list failing resources using GET /alert filtered by policy.complianceMetadata.standardName
Multi-Cloud Alert Triage
Triage cloud security alerts across AWS, Azure, and GCP environments by querying Prisma Cloud's unified alert system. The API aggregates misconfiguration findings, anomalous activity detections, and policy violations into a single interface with filtering by severity, cloud type, account group, and policy category. Security teams reduce alert fatigue by programmatically dismissing resolved findings and focusing on critical risks.
Query GET /alert for high-severity alerts in the last 24 hours, retrieve detailed findings for the top 5 via GET /alert/{id}, and dismiss resolved ones via POST /alert/dismiss
Cloud Account Onboarding and Monitoring
Onboard new cloud accounts from AWS, Azure, or GCP into Prisma Cloud for continuous security monitoring. The API handles cloud account registration, validates connectivity and permissions, monitors onboarding status, and assigns accounts to account groups for policy inheritance. Automated onboarding reduces time-to-protection from days to minutes for new cloud subscriptions added to the organization.
Onboard an AWS account via POST /cloud/aws with the account ID and role ARN, then check status via GET /cloud/aws/{id}/status
Asset Inventory and Risk Assessment
Query the complete inventory of cloud assets across all onboarded accounts with filtering by resource type, region, and compliance violation status. The search API enables discovery of misconfigured resources like public S3 buckets, overly permissive security groups, and unencrypted databases. Asset data includes configuration details, compliance mappings, and risk scores for prioritized remediation.
Search for all public S3 buckets using POST /search with a RQL query filtering by cloud.type='aws' and resource.type='aws_s3_bucket' with publicAccessBlockConfiguration violations
Key Endpoints
91 endpoints — jentic publishes the only available openapi specification for prisma cloud cspm api, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/alert
List cloud security alerts with filtering
GET
/alert/{id}
Retrieve detailed alert information by ID
POST
/alert/dismiss
Dismiss resolved alerts with reason
GET
/compliance/posture
Get compliance posture summary across frameworks
GET
/compliance/posture/{complianceId}
Retrieve posture for a specific compliance standard
POST
/cloud/{cloudType}
Onboard a new cloud account
GET
/cloud/{cloudType}/{id}/status
Check cloud account onboarding status
GET
/audit_logs
Retrieve administrative audit log events
GET
/alert
List cloud security alerts with filtering
GET
/alert/{id}
Retrieve detailed alert information by ID
POST
/alert/dismiss
Dismiss resolved alerts with reason
GET
/compliance/posture
Get compliance posture summary across frameworks
GET
/compliance/posture/{complianceId}
Retrieve posture for a specific compliance standard
POST
/cloud/{cloudType}
Onboard a new cloud account
GET
/cloud/{cloudType}/{id}/status
Check cloud account onboarding status
GET
/audit_logs
Retrieve administrative audit log events
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Prisma Cloud access keys are stored encrypted in the Jentic vault (MAXsystem). Agents receive scoped bearer tokens with automatic refresh — raw access keys and secret keys never enter the agent's context window.
Intent-based discovery
Agents search by intent (e.g., 'check cloud compliance posture') and Jentic returns matching Prisma Cloud operations with their input schemas, so the agent can call the right endpoint without navigating Palo Alto Networks documentation or determining the correct regional stack.
Time to first call
Direct Prisma Cloud integration: 2-4 days for auth flow, regional endpoint selection, and RQL query formatting. Through Jentic: under 1 hour — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Prisma Cloud CSPM API through Jentic.
Why is there no official OpenAPI spec for Prisma Cloud CSPM API?
Palo Alto Networks does not publish an OpenAPI specification for Prisma Cloud CSPM. Jentic generates and maintains this spec so that AI agents and developers can call Prisma Cloud CSPM API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the Prisma Cloud CSPM API use?
The Prisma Cloud CSPM API uses bearer token authentication. You authenticate via POST /login with your access key and secret key to receive a JWT token valid for 10 minutes, extendable via POST /auth_token/extend. Through Jentic, credentials are stored encrypted in the MAXsystem vault with automatic token refresh.
Can I check compliance posture against specific frameworks with the Prisma Cloud API?
Yes. Use GET /compliance/posture for an overview across all frameworks, or GET /compliance/posture/{complianceId} for a specific standard like CIS AWS Foundations Benchmark. The response includes pass/fail counts per section, overall compliance percentage, and a list of failing resources with policy details.
What are the rate limits for the Prisma Cloud CSPM API?
Prisma Cloud enforces rate limits that vary by endpoint and tenant tier. Alert and compliance queries allow several hundred requests per minute. The API returns 429 status codes when limits are exceeded. Bearer tokens expire after 10 minutes, requiring refresh via the auth_token/extend endpoint.
How do I triage cloud security alerts through Jentic?
Search Jentic for 'triage cloud security alerts', which returns the GET /alert and POST /alert/dismiss operations. Query alerts filtered by severity and cloud account, review detailed findings, and dismiss resolved ones with a documented reason. Install with pip install jentic and authenticate at https://app.jentic.com/sign-up.
Which cloud providers does the Prisma Cloud CSPM API support?
The API supports AWS, Azure, and GCP cloud accounts. Onboard each provider via POST /cloud/{cloudType} where cloudType is 'aws', 'azure', or 'gcp'. Each provider requires specific connection parameters — AWS uses a cross-account role ARN, Azure uses a service principal, and GCP uses a service account key.
Can I search for specific misconfigured cloud resources?
Yes. The POST /search endpoint accepts Resource Query Language (RQL) queries to find specific resource types with compliance violations. For example, you can query for all S3 buckets without encryption enabled, all security groups with unrestricted inbound rules, or all databases without backup configured.
GET STARTED