Paloaltonetworks Prisma Cloud CSPM API

Name: Prisma Cloud CSPM API
Brand: Prisma Cloud CSPM API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityCompliancebearer91 Endpoints

Install Jentic One Beta

Connect the Prisma Cloud CSPM API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Prisma Cloud CSPM API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Prisma Cloud CSPM API.

Query and dismiss cloud security alerts filtered by severity, policy type, and cloud account

Run compliance posture checks against CIS, NIST, SOC 2, and PCI-DSS frameworks with pass/fail breakdowns

Onboard and manage cloud accounts from AWS, Azure, and GCP with status monitoring

GET STARTED

Start building with Prisma Cloud CSPM API

Explore with Jentic

View OpenAPI Document

For Agents

Query cloud security alerts, check compliance posture, manage security policies, and inventory multi-cloud assets across AWS, Azure, and GCP through Palo Alto Networks' Prisma Cloud CSPM platform.

Use for: I need to check the compliance posture of my AWS accounts against CIS benchmarks, List all open high-severity cloud security alerts from the last week, Dismiss a resolved alert and document the remediation reason, Find all S3 buckets that violate public access policies

Not supported: Does not handle endpoint protection, network firewall rules, or application-layer security - use for cloud infrastructure posture management and compliance monitoring only.

Use Cases

Patterns agents use Prisma Cloud CSPM API for, with concrete tasks.

★ AI Agent Cloud Compliance Monitoring

An AI agent uses the Prisma Cloud CSPM API through Jentic to continuously monitor multi-cloud compliance posture, querying compliance endpoints to retrieve pass/fail scores against CIS, NIST, and PCI-DSS frameworks. The agent identifies drifting resources, retrieves specific alert details, and can trigger remediation actions - all without manually configuring bearer token refresh or discovering the correct regional API endpoint.

Retrieve the compliance posture via GET /compliance/posture for the CIS framework, then list failing resources using GET /alert filtered by policy.complianceMetadata.standardName

Multi-Cloud Alert Triage

Triage cloud security alerts across AWS, Azure, and GCP environments by querying Prisma Cloud's unified alert system. The API aggregates misconfiguration findings, anomalous activity detections, and policy violations into a single interface with filtering by severity, cloud type, account group, and policy category. Security teams reduce alert fatigue by programmatically dismissing resolved findings and focusing on critical risks.

Query GET /alert for high-severity alerts in the last 24 hours, retrieve detailed findings for the top 5 via GET /alert/{id}, and dismiss resolved ones via POST /alert/dismiss

Cloud Account Onboarding and Monitoring

Onboard new cloud accounts from AWS, Azure, or GCP into Prisma Cloud for continuous security monitoring. The API handles cloud account registration, validates connectivity and permissions, monitors onboarding status, and assigns accounts to account groups for policy inheritance. Automated onboarding reduces time-to-protection from days to minutes for new cloud subscriptions added to the organization.

Onboard an AWS account via POST /cloud/aws with the account ID and role ARN, then check status via GET /cloud/aws/{id}/status

Asset Inventory and Risk Assessment

Query the complete inventory of cloud assets across all onboarded accounts with filtering by resource type, region, and compliance violation status. The search API enables discovery of misconfigured resources like public S3 buckets, overly permissive security groups, and unencrypted databases. Asset data includes configuration details, compliance mappings, and risk scores for prioritized remediation.

Search for all public S3 buckets using POST /search with a RQL query filtering by cloud.type='aws' and resource.type='aws_s3_bucket' with publicAccessBlockConfiguration violations

Key Endpoints

91 endpoints — jentic publishes the only available openapi specification for prisma cloud cspm api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/alert

List cloud security alerts with filtering

GET

/alert/{id}

Retrieve detailed alert information by ID

POST

/alert/dismiss

Dismiss resolved alerts with reason

GET

/compliance/posture

Get compliance posture summary across frameworks

GET

/compliance/posture/{complianceId}

Retrieve posture for a specific compliance standard

POST

/cloud/{cloudType}

Onboard a new cloud account

GET

/cloud/{cloudType}/{id}/status

Check cloud account onboarding status

GET

/audit_logs

Retrieve administrative audit log events

GET

/alert

List cloud security alerts with filtering

GET

/alert/{id}

Retrieve detailed alert information by ID

POST

/alert/dismiss

Dismiss resolved alerts with reason

GET

/compliance/posture

Get compliance posture summary across frameworks

GET

/compliance/posture/{complianceId}

Retrieve posture for a specific compliance standard

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Prisma Cloud access key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'check cloud compliance posture' or 'list open alerts', and Jentic returns the matching Prisma Cloud operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

Time to first call

FAQs

Specific to using Prisma Cloud CSPM API through Jentic.

Why is there no official OpenAPI spec for Prisma Cloud CSPM API?

Palo Alto Networks does not publish an OpenAPI specification for Prisma Cloud CSPM. Jentic generates and maintains this spec so that AI agents and developers can call Prisma Cloud CSPM API via structured tooling. It is validated against the live API and kept up to date. get started with Jentic One, the self-hosted execution layer.

What authentication does the Prisma Cloud CSPM API use?

The Prisma Cloud CSPM API uses bearer token authentication. You authenticate via POST /login with your access key and secret key to receive a JWT token valid for 10 minutes, extendable via POST /auth_token/extend. Through Jentic, credentials are stored encrypted in your Jentic One instance with automatic token refresh.

Can I check compliance posture against specific frameworks with the Prisma Cloud API?

Yes. Use GET /compliance/posture for an overview across all frameworks, or GET /compliance/posture/{complianceId} for a specific standard like CIS AWS Foundations Benchmark. The response includes pass/fail counts per section, overall compliance percentage, and a list of failing resources with policy details.

What are the rate limits for the Prisma Cloud CSPM API?

Prisma Cloud enforces rate limits that vary by endpoint and tenant tier. Alert and compliance queries allow several hundred requests per minute. The API returns 429 status codes when limits are exceeded. Bearer tokens expire after 10 minutes, requiring refresh via the auth_token/extend endpoint.

How do I triage cloud security alerts through Jentic?

Search Jentic for 'triage cloud security alerts', which returns the GET /alert and POST /alert/dismiss operations. Query alerts filtered by severity and cloud account, review detailed findings, and dismiss resolved ones with a documented reason. Install with pip install jentic and authenticate through Jentic One, the self-hosted execution layer.

Which cloud providers does the Prisma Cloud CSPM API support?

The API supports AWS, Azure, and GCP cloud accounts. Onboard each provider via POST /cloud/{cloudType} where cloudType is 'aws', 'azure', or 'gcp'. Each provider requires specific connection parameters - AWS uses a cross-account role ARN, Azure uses a service principal, and GCP uses a service account key.

Can I search for specific misconfigured cloud resources?

Yes. The POST /search endpoint accepts Resource Query Language (RQL) queries to find specific resource types with compliance violations. For example, you can query for all S3 buckets without encryption enabled, all security groups with unrestricted inbound rules, or all databases without backup configured.

Paloaltonetworks Prisma Cloud CSPM API

Connect the Prisma Cloud CSPM API to your agent

Capabilities

Start building with Prisma Cloud CSPM API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs