Incident Security Service Posture Management API — SaaS Instance

naftiko: 1.0.0-alpha2
info:
  label: Incident Security Service Posture Management API — SaaS Instance
  description: 'Incident Security Service Posture Management API — SaaS Instance. 9 operations. Lead operation: Palo Alto
    Networks Get SaaS Instance List. Self-contained Naftiko capability covering one Palo Alto Networks business surface.'
  tags:
  - Palo Alto Networks
  - SaaS Instance
  created: '2026-05-19'
  modified: '2026-05-19'
binds:
- namespace: env
  keys:
    PALO_ALTO_NETWORKS_API_KEY: PALO_ALTO_NETWORKS_API_KEY
capability:
  consumes:
  - type: http
    namespace: palo-alto-identity-security-posture-management-saas-instance
    baseUri: https://api.sase.paloaltonetworks.com
    description: Incident Security Service Posture Management API — SaaS Instance business capability. Self-contained, no
      shared references.
    resources:
    - name: sspm-identity-v1-saas_instances
      path: /sspm/identity/v1/saas_instances
      operations:
      - name: saasinstancesget
        method: GET
        description: Palo Alto Networks Get SaaS Instance List
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts
      path: /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts
      operations:
      - name: saasinstancessaasaccountsget
        method: GET
        description: Palo Alto Networks Get SaaS Account List
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: saasInstanceId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: limit
          in: query
          type: integer
        - name: page
          in: query
          type: integer
        - name: sortBy
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts-count
      path: /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/count
      operations:
      - name: saasinstancessaasaccountscountget
        method: GET
        description: Palo Alto Networks Get SaaS Account Count
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: saasInstanceId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts-csv_report
      path: /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_accounts/csv_report
      operations:
      - name: saasinstancessaasaccountscountcsvreportpost
        method: POST
        description: Palo Alto Networks Generate SaaS Account CSV Report
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: saasInstanceId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: sortBy
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: sspm-identity-v1-saas_instances-saasInstanceId-saas_activity
      path: /sspm/identity/v1/saas_instances/{saasInstanceId}/saas_activity
      operations:
      - name: saasinstancessaasactivityget
        method: GET
        description: Palo Alto Networks Get SaaS Activity Logs
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: saasInstanceId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: limit
          in: query
          type: integer
        - name: page
          in: query
          type: integer
        - name: sortBy
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
    - name: sspm-identity-v1-saasInstanceId-tickets
      path: /sspm/identity/v1/{saasInstanceId}/tickets
      operations:
      - name: saasinstancesticketsget
        method: GET
        description: Palo Alto Networks Get SaaS Instance Tickets
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: saasInstanceId
          in: path
          type: string
          required: true
        - name: filter
          in: query
          type: string
        - name: limit
          in: query
          type: integer
        - name: page
          in: query
          type: integer
        - name: sortBy
          in: query
          type: string
        - name: x-ps-tenant
          in: header
          type: string
      - name: saasinstancesticketspost
        method: POST
        description: Palo Alto Networks Create SaaS Instance Ticket
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: saasInstanceId
          in: path
          type: string
          required: true
        - name: x-ps-tenant
          in: header
          type: string
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
      - name: saasinstancesticketsdelete
        method: DELETE
        description: Palo Alto Networks Delete SaaS Instance Tickets
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: saasInstanceId
          in: path
          type: string
          required: true
        - name: x-ps-tenant
          in: header
          type: string
        - name: body
          in: body
          type: object
          description: Request body (JSON).
          required: false
    - name: sspm-identity-v1-saasInstanceId-tickets-ticketKey-issues
      path: /sspm/identity/v1/{saasInstanceId}/tickets/{ticketKey}/issues
      operations:
      - name: saasinstancesticketsissuesget
        method: GET
        description: Palo Alto Networks Get Ticket Issues
        outputRawFormat: json
        outputParameters:
        - name: result
          type: object
          value: $.
        inputParameters:
        - name: saasInstanceId
          in: path
          type: string
          required: true
        - name: ticketKey
          in: path
          type: string
          required: true
        - name: limit
          in: query
          type: integer
        - name: page
          in: query
          type: integer
        - name: x-ps-tenant
          in: header
          type: string
  exposes:
  - type: rest
    namespace: palo-alto-identity-security-posture-management-saas-instance-rest
    port: 8080
    description: REST adapter for Incident Security Service Posture Management API — SaaS Instance. One Spectral-compliant
      resource per consumed operation, prefixed with /v1.
    resources:
    - path: /v1/sspm/identity/v1/saas-instances
      name: sspm-identity-v1-saas-instances
      description: REST surface for sspm-identity-v1-saas_instances.
      operations:
      - method: GET
        name: saasinstancesget
        description: Palo Alto Networks Get SaaS Instance List
        call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesget
        with:
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/saas-instances/{saasinstanceid}/saas-accounts
      name: sspm-identity-v1-saas-instances-saasinstanceid-saas-accounts
      description: REST surface for sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts.
      operations:
      - method: GET
        name: saasinstancessaasaccountsget
        description: Palo Alto Networks Get SaaS Account List
        call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountsget
        with:
          saasInstanceId: rest.saasInstanceId
          filter: rest.filter
          limit: rest.limit
          page: rest.page
          sortBy: rest.sortBy
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/saas-instances/{saasinstanceid}/saas-accounts/count
      name: sspm-identity-v1-saas-instances-saasinstanceid-saas-accounts-count
      description: REST surface for sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts-count.
      operations:
      - method: GET
        name: saasinstancessaasaccountscountget
        description: Palo Alto Networks Get SaaS Account Count
        call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountscountget
        with:
          saasInstanceId: rest.saasInstanceId
          filter: rest.filter
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/saas-instances/{saasinstanceid}/saas-accounts/csv-report
      name: sspm-identity-v1-saas-instances-saasinstanceid-saas-accounts-csv-report
      description: REST surface for sspm-identity-v1-saas_instances-saasInstanceId-saas_accounts-csv_report.
      operations:
      - method: POST
        name: saasinstancessaasaccountscountcsvreportpost
        description: Palo Alto Networks Generate SaaS Account CSV Report
        call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountscountcsvreportpost
        with:
          saasInstanceId: rest.saasInstanceId
          filter: rest.filter
          sortBy: rest.sortBy
          x-ps-tenant: rest.x-ps-tenant
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/saas-instances/{saasinstanceid}/saas-activity
      name: sspm-identity-v1-saas-instances-saasinstanceid-saas-activity
      description: REST surface for sspm-identity-v1-saas_instances-saasInstanceId-saas_activity.
      operations:
      - method: GET
        name: saasinstancessaasactivityget
        description: Palo Alto Networks Get SaaS Activity Logs
        call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasactivityget
        with:
          saasInstanceId: rest.saasInstanceId
          filter: rest.filter
          limit: rest.limit
          page: rest.page
          sortBy: rest.sortBy
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/{saasinstanceid}/tickets
      name: sspm-identity-v1-saasinstanceid-tickets
      description: REST surface for sspm-identity-v1-saasInstanceId-tickets.
      operations:
      - method: GET
        name: saasinstancesticketsget
        description: Palo Alto Networks Get SaaS Instance Tickets
        call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsget
        with:
          saasInstanceId: rest.saasInstanceId
          filter: rest.filter
          limit: rest.limit
          page: rest.page
          sortBy: rest.sortBy
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
      - method: POST
        name: saasinstancesticketspost
        description: Palo Alto Networks Create SaaS Instance Ticket
        call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketspost
        with:
          saasInstanceId: rest.saasInstanceId
          x-ps-tenant: rest.x-ps-tenant
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
      - method: DELETE
        name: saasinstancesticketsdelete
        description: Palo Alto Networks Delete SaaS Instance Tickets
        call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsdelete
        with:
          saasInstanceId: rest.saasInstanceId
          x-ps-tenant: rest.x-ps-tenant
          body: rest.body
        outputParameters:
        - type: object
          mapping: $.
    - path: /v1/sspm/identity/v1/{saasinstanceid}/tickets/{ticketkey}/issues
      name: sspm-identity-v1-saasinstanceid-tickets-ticketkey-issues
      description: REST surface for sspm-identity-v1-saasInstanceId-tickets-ticketKey-issues.
      operations:
      - method: GET
        name: saasinstancesticketsissuesget
        description: Palo Alto Networks Get Ticket Issues
        call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsissuesget
        with:
          saasInstanceId: rest.saasInstanceId
          ticketKey: rest.ticketKey
          limit: rest.limit
          page: rest.page
          x-ps-tenant: rest.x-ps-tenant
        outputParameters:
        - type: object
          mapping: $.
  - type: mcp
    namespace: palo-alto-identity-security-posture-management-saas-instance-mcp
    port: 9090
    transport: http
    description: MCP adapter for Incident Security Service Posture Management API — SaaS Instance. One tool per consumed operation,
      routed inline through this capability's consumes block.
    tools:
    - name: palo-alto-networks-get-saas
      description: Palo Alto Networks Get SaaS Instance List
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesget
      with:
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-saas-2
      description: Palo Alto Networks Get SaaS Account List
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountsget
      with:
        saasInstanceId: tools.saasInstanceId
        filter: tools.filter
        limit: tools.limit
        page: tools.page
        sortBy: tools.sortBy
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-saas-3
      description: Palo Alto Networks Get SaaS Account Count
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountscountget
      with:
        saasInstanceId: tools.saasInstanceId
        filter: tools.filter
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-generate-saas
      description: Palo Alto Networks Generate SaaS Account CSV Report
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasaccountscountcsvreportpost
      with:
        saasInstanceId: tools.saasInstanceId
        filter: tools.filter
        sortBy: tools.sortBy
        x-ps-tenant: tools.x-ps-tenant
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-saas-4
      description: Palo Alto Networks Get SaaS Activity Logs
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-saas-instance.saasinstancessaasactivityget
      with:
        saasInstanceId: tools.saasInstanceId
        filter: tools.filter
        limit: tools.limit
        page: tools.page
        sortBy: tools.sortBy
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-saas-5
      description: Palo Alto Networks Get SaaS Instance Tickets
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsget
      with:
        saasInstanceId: tools.saasInstanceId
        filter: tools.filter
        limit: tools.limit
        page: tools.page
        sortBy: tools.sortBy
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-create-saas
      description: Palo Alto Networks Create SaaS Instance Ticket
      hints:
        readOnly: false
        destructive: false
        idempotent: false
      call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketspost
      with:
        saasInstanceId: tools.saasInstanceId
        x-ps-tenant: tools.x-ps-tenant
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-delete-saas
      description: Palo Alto Networks Delete SaaS Instance Tickets
      hints:
        readOnly: false
        destructive: true
        idempotent: true
      call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsdelete
      with:
        saasInstanceId: tools.saasInstanceId
        x-ps-tenant: tools.x-ps-tenant
        body: tools.body
      outputParameters:
      - type: object
        mapping: $.
    - name: palo-alto-networks-get-ticket
      description: Palo Alto Networks Get Ticket Issues
      hints:
        readOnly: true
        destructive: false
        idempotent: true
      call: palo-alto-identity-security-posture-management-saas-instance.saasinstancesticketsissuesget
      with:
        saasInstanceId: tools.saasInstanceId
        ticketKey: tools.ticketKey
        limit: tools.limit
        page: tools.page
        x-ps-tenant: tools.x-ps-tenant
      outputParameters:
      - type: object
        mapping: $.