{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":43738,"path":"security-management/configuration-compliance/prisma-cloud-rest-messages.md","title":"Prisma Cloud REST Messages","bundle":null,"doc_type":null,"release":"australia","body":"\n# Prisma Cloud REST Messages\n\nPrisma REST messages are used to make calls to the Prisma Application Programming Interface \\(API\\) to fetch the compliance data.\n\nThe following REST messages are shipped with the base system.\n\n## Prisma Cloud integrations\n\nAll Prisma Cloud integrations use the JSON Web Token \\(JWT\\) for authentication and authorization.\n\n<table id=\"table_v2g_x1q_dt\"><thead><tr><th>\n\nEndpoint\n\n</th><th>\n\nDescription\n\n</th><th>\n\nMethod\n\n</th><th>\n\nBody\n\n</th><th>\n\nAPI documentation link\n\n</th></tr></thead><tbody><tr><td>\n\n/login\n\n</td><td>\n\nObtains the JWT token for use in all subsequent integrations.\n\n</td><td>\n\nPOST\n\n</td><td>\n\n```\n{ \"username\": <<access key id >>, \n\"password\": <<secret access key>>}\n```\n\n</td><td>\n\n[https://pan.dev/prisma-cloud/api/cspm/app-login/](https://pan.dev/prisma-cloud/api/cspm/app-login/)\n\n</td></tr></tbody>\n</table>|Endpoint|Description|Method|Body|API documentation link|\n|--------|-----------|------|----|----------------------|\n|/auth\\_token/extend|Automatically renews the JWT token on expiration. The default duration for token expiry is 60 minutes.|GET|NA|[https://pan.dev/prisma-cloud/api/cspm/extend-session/](https://pan.dev/prisma-cloud/api/cspm/extend-session/)|\n\n|Endpoint|Description|Method|Body|API documentation link|\n|--------|-----------|------|----|----------------------|\n|/v2/policy|Retrieves all the policy data from Prisma.|GET|NA|[https://pan.dev/prisma-cloud/api/cspm/get-policies/](https://pan.dev/prisma-cloud/api/cspm/get-policies/)|\n\n<table id=\"table_tjw_nrf_t1c\"><thead><tr><th>\n\nEndpoint\n\n</th><th>\n\nDescription\n\n</th><th>\n\nMethod\n\n</th><th>\n\nBody\n\n</th><th>\n\nAPI documentation link\n\n</th></tr></thead><tbody><tr><td>\n\n/v2/alert\n\n</td><td>\n\nRetrieves all alerts from Prisma.\n\n</td><td>\n\nPOST\n\n</td><td>\n\n```\n{\n    \"detailed\": \"false\",\n    \"filters\": [\n\t{\n\n\t\t\"name\": \"timeRange.type\",\n                \"operator\": \"=\",\n                \"value\": \"ALERT_STATUS_UPDATED\"\n        }\n    ],\n    \"sortBy\": [\n        \"resource.id\"\n    ],\n    \"pageToken\": \"\",\n    \"offset\": 0,\n    \"limit\": 2000,\n    \"timeRange\": {\n        \"type\": \"absolute\",\n        \"value\": {\n            \"startTime\": <<Import since at integration level>>,\n            \"endTime\": << Current integration  run time>>\n        }\n    }\n}\n```\n\n</td><td>\n\n[https://pan.dev/prisma-cloud/api/cspm/post-alerts/](https://pan.dev/prisma-cloud/api/cspm/post-alerts/)\n\n</td></tr></tbody>\n</table>For Prisma Comprehensive Alert integration, the filters in the above POST body must be replaced as follows:\n\n```\n\"filters\": [\n\t{\n                    \"name\": \"alert.status\",\n                    \"operator\": \"=\",\n                    \"value\": \"open\"\n                },\n                {\n                    \"name\": \"alert.status\",\n                    \"operator\": \"=\",\n                    \"value\": \"dismissed\"\n                },\n                {\n                    \"name\": \"alert.status\",\n                    \"operator\": \"=\",\n                    \"value\": \"snoozed\"\n                },\n                {\n                    \"name\": \"alert.status\",\n                    \"operator\": \"=\",\n                    \"value\": \"pending_resolution\"\n                },\n                {\n                    \"name\": \"timeRange.type\",\n                    \"operator\": \"=\",\n                    \"value\": \"ALERT_UPDATED\"\n                }\n \n    ],\n```\n\n"}}