openapi: 3.0.0
info:
  title: Prisma Browser Management Console Public API
  description: This Open API spec file represents the APIs available for Palo Alto Networks Prisma Browser Management APIs. These APIs are available for all Prisma Browser tenants to scale and automate their processes related to the browser. All of the functionality exposed by these APIs can also be performed using the Prisma Browser User Interface. These APIs use the common SASE authentication mechanism and base URL. See the Prisma SASE API Get Started guide for more information. © 2026 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.
  version: 1.0.0
servers:
  - url: https://api.sase.paloaltonetworks.com
security:
  - BearerAuth: []
tags:
  - name: Users Read
    description: Look up users known to the browser management console.
  - name: Users Actions
    description: Suspend, resume, and force re-authentication for users.
  - name: User Requests
    description: Review and act on end-user access and app-login requests.
  - name: Devices Read
    description: Look up devices known to the browser management console.
  - name: Devices Actions
    description: Archive, restore, suspend, resume, delete, and force re-authentication for devices.
  - name: User Groups
    description: Manage user groups used by browser policies.
  - name: Device Groups
    description: Manage device groups used by browser policies.
  - name: Applications Read
    description: Look up application objects and the available application categories.
  - name: Applications Actions
    description: Create, update, and delete individual application objects.
  - name: Applications Bulk
    description: Create or delete many application objects in a single request.
  - name: Application Groups
    description: Manage logical groupings of applications.
  - name: Configuration Management
    description: Manage publishing of policy and configuration drafts, and exporting the tenant configuration.
  - name: Sign-In Overview
    description: Retrieve the full sign-in policy.
  - name: Sign-In Rules
    description: Manage sign-in policy rules.
  - name: Sign-In Sections
    description: Manage sign-in policy sections.
  - name: Sign-In Positions
    description: Reorder sign-in policy rules and sections.
  - name: Security Overview
    description: Retrieve the full security policy.
  - name: Security Rules
    description: Manage security policy rules.
  - name: Security Sections
    description: Manage security policy sections.
  - name: Security Positions
    description: Reorder security policy rules and sections.
  - name: Access and Data Overview
    description: Retrieve the full access-and-data policy.
  - name: Access and Data Rules
    description: Manage access-and-data policy rules.
  - name: Access and Data Sections
    description: Manage access-and-data policy sections.
  - name: Access and Data Positions
    description: Reorder access-and-data policy rules and sections.
  - name: Customization Overview
    description: Retrieve the full customization policy.
  - name: Customization Rules
    description: Manage customization policy rules.
  - name: Customization Sections
    description: Manage customization policy sections.
  - name: Customization Positions
    description: Reorder customization policy rules and sections.
  - name: Assets
    description: Upload branding and configuration assets such as logos, icons, and PAC files.
  - name: Integrations
    x-displayName: Cloud Storage
    description: Manage cloud storage provider integrations.
  - name: IDP Application Sync
    description: Manage IDP Application Sync provider integrations.
  - name: Application Plugins
    description: Manage application plugins. Aligns with the pan.dev published taxonomy.
x-tagGroups:
  - name: Sign-In Policy
    tags:
      - Sign-In Overview
      - Sign-In Rules
      - Sign-In Sections
      - Sign-In Positions
  - name: Security Policy
    tags:
      - Security Overview
      - Security Rules
      - Security Sections
      - Security Positions
  - name: Access and Data Policy
    tags:
      - Access and Data Overview
      - Access and Data Rules
      - Access and Data Sections
      - Access and Data Positions
  - name: Customization Policy
    tags:
      - Customization Overview
      - Customization Rules
      - Customization Sections
      - Customization Positions
  - name: Assets
    tags:
      - Assets
  - name: Users
    tags:
      - Users Read
      - Users Actions
  - name: User Requests
    tags:
      - User Requests
  - name: User Groups
    tags:
      - User Groups
  - name: Devices
    tags:
      - Devices Read
      - Devices Actions
  - name: Device Groups
    tags:
      - Device Groups
  - name: Applications
    tags:
      - Applications Read
      - Applications Actions
      - Applications Bulk
  - name: Application Groups
    tags:
      - Application Groups
  - name: Application Plugins
    tags:
      - Application Plugins
  - name: Configuration Management
    tags:
      - Configuration Management
  - name: Integrations
    tags:
      - Integrations
      - IDP Application Sync
paths:
  /seb-api/v1/users:
    get:
      operationId: ListUsers
      tags:
        - Users Read
      summary: Returns a list of users
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - name: limit
          in: query
          description: Number of users to return
          required: false
          schema:
            type: integer
            format: int32
        - name: includeDeleted
          in: query
          description: Include deleted users
          required: false
          schema:
            type: boolean
        - name: user.name
          in: query
          description: Filter by user name
          required: false
          schema:
            type: string
        - name: user.email
          in: query
          description: Filter by user email
          required: false
          schema:
            type: string
        - name: user.first_seen_gte
          in: query
          description: Filter by first seen time or after
          required: false
          schema:
            type: string
            format: date-time
        - name: user.last_seen_lte
          in: query
          description: Filter by last seen time or before
          required: false
          schema:
            type: string
            format: date-time
        - name: user.status
          in: query
          description: Filter by user status
          required: false
          schema:
            $ref: '#/components/schemas/UserStatus'
        - name: groupId
          in: query
          description: Filter by user group ID. Supports comma-separated values to filter by multiple groups (e.g. groupId=id1,id2,id3).
          required: false
          schema:
            type: string
        - name: cursor
          in: query
          description: An optional opaque string that defines from where to start listing
          required: false
          schema:
            type: string
        - name: sort
          in: query
          description: The field to sort by
          required: false
          schema:
            type: string
            enum:
              - user.name
              - user.email
              - user.first_seen
              - user.last_seen
              - user.status
        - name: order
          in: query
          description: The sort order
          required: false
          schema:
            $ref: '#/components/schemas/Order'
      responses:
        '200':
          description: A list of users with pagination info
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/User'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/users/{id}:
    get:
      operationId: GetUserByID
      tags:
        - Users Read
      summary: Returns a user by ID
      parameters:
        - name: id
          in: path
          description: User ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: A user
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
        '404':
          description: User not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/users/suspend:
    post:
      operationId: SuspendUsers
      tags:
        - Users Actions
      summary: Suspend users
      description: Suspend one or more users by changing their status to suspended. Suspended users will lose access to the browser from all of their known or future devices, except from their Prisma Browser Extension and mobile devices.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserStatusChangeRequest'
      responses:
        '200':
          description: Users suspended successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserSuspendResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserBadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: One or more users not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/users/resume:
    post:
      operationId: ResumeUsers
      tags:
        - Users Actions
      summary: Resume suspended users
      description: Resume one or more suspended users by changing their status to active. Resumed users will regain access to the browser from all of their known or future devices.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserStatusChangeRequest'
      responses:
        '200':
          description: Users resumed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserResumeResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserBadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: One or more users not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/users/force-reauth:
    post:
      operationId: ForceReauthUsers
      tags:
        - Users Actions
      summary: Force re-authentication for users
      description: Force re-authentication on all active devices for one or more users. Upon execution, targeted users will be required to re-authenticate to the browser on all of their devices.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UserStatusChangeRequest'
      responses:
        '200':
          description: Force re-authentication initiated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserForceReauthResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserBadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: One or more users not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UsersNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/devices:
    get:
      operationId: ListDevices
      tags:
        - Devices Read
      summary: Returns a list of devices
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - name: limit
          in: query
          description: Number of devices to return
          required: false
          schema:
            type: integer
            format: int32
        - name: device.hostname
          in: query
          description: Filter by hostname
          required: false
          schema:
            type: string
        - name: user.name
          in: query
          description: Filter by user name
          required: false
          schema:
            type: string
        - name: device.os_type
          in: query
          description: Filter by OS type
          required: false
          schema:
            type: string
        - name: device.first_seen_gte
          in: query
          description: Filter by first seen time or after
          required: false
          schema:
            type: string
            format: date-time
        - name: device.last_seen_lte
          in: query
          description: Filter by last seen time or before
          required: false
          schema:
            type: string
            format: date-time
        - name: device.last_seen_gte
          in: query
          description: Filter by last seen time or after
          required: false
          schema:
            type: string
            format: date-time
        - name: device.type
          in: query
          description: Filter by device type
          required: false
          schema:
            type: string
        - name: device.firewall_status
          in: query
          description: Filter by firewall status
          required: false
          schema:
            type: string
        - name: device.screen_lock_status
          in: query
          description: Filter by screen lock status
          required: false
          schema:
            type: string
        - name: device.disk_encryption_status
          in: query
          description: Filter by disk encryption status
          required: false
          schema:
            type: string
        - name: cursor
          in: query
          description: An optional opaque string that defines from where to start listing
          required: false
          schema:
            type: string
        - name: sort
          in: query
          description: The field to sort by
          required: false
          schema:
            type: string
            enum:
              - device.hostname
              - device.os_type
              - device.browser_version
              - device.first_seen
              - device.last_seen
              - user.name
        - name: order
          in: query
          description: The sort order
          required: false
          schema:
            $ref: '#/components/schemas/Order'
      responses:
        '200':
          description: A list of devices with pagination info
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Device'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/devices/{id}:
    get:
      operationId: GetDeviceByID
      tags:
        - Devices Read
      summary: Returns a device by ID
      parameters:
        - name: id
          in: path
          description: Device ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: A device
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Device'
        '404':
          description: Device not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/devices/archive:
    post:
      operationId: ArchiveDevices
      tags:
        - Devices Actions
      summary: Archive devices
      description: Archive one or more devices by changing their status to archived
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      responses:
        '200':
          description: Devices archived successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceArchiveResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ArchiveDevicesBadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DevicesNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/devices/restore:
    post:
      operationId: RestoreDevices
      tags:
        - Devices Actions
      summary: Restore archived devices
      description: Restore one or more archived devices by changing their status to active
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      responses:
        '200':
          description: Devices restored successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceRestoreResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RestoreDevicesBadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DevicesNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/devices/suspend:
    post:
      operationId: SuspendDevices
      tags:
        - Devices Actions
      summary: Suspend devices
      description: Suspend one or more devices by changing their status to suspended
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      responses:
        '200':
          description: Devices suspended successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceSuspendResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuspendDevicesBadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DevicesNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/devices/resume:
    post:
      operationId: ResumeDevices
      tags:
        - Devices Actions
      summary: Resume suspended devices
      description: Resume one or more suspended devices by changing their status to active
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      responses:
        '200':
          description: Devices resumed successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceResumeResponse'
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ResumeDevicesBadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DevicesNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/devices/delete:
    post:
      operationId: DeleteDevices
      tags:
        - Devices Actions
      summary: Delete devices
      description: Delete one or more devices permanently. Suspended devices cannot be deleted - they must be resumed first.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      responses:
        '200':
          description: Devices deleted successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceDeleteResponse'
        '400':
          description: Bad request - invalid input or attempting to delete suspended devices
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteDevicesBadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DevicesNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/devices/force-reauth:
    post:
      operationId: ForceReauthDevices
      tags:
        - Devices Actions
      summary: Force re-authentication for devices
      description: Force re-authentication on one or more specific devices. Upon execution, targeted devices will require their user to re-authenticate to the browser.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceStatusChangeRequest'
      responses:
        '200':
          description: Force re-authentication initiated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceForceReauthResponse'
        '400':
          description: Bad request - invalid input or too many devices
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForceReauthDevicesBadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: One or more devices not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DevicesNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/user-groups:
    get:
      operationId: ListUserGroups
      tags:
        - User Groups
      summary: Returns a list of user groups
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - name: limit
          in: query
          description: Number of user requests to return
          required: false
          schema:
            type: integer
            format: int32
        - name: cursor
          in: query
          description: An optional opaque string that defines from where to start listing
          required: false
          schema:
            type: string
      responses:
        '200':
          description: A list of user groups
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/UserGroup'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Configuration version not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    post:
      operationId: CreateUserGroup
      tags:
        - User Groups
      summary: Creates a new user group
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                name:
                  type: string
                  description: Name of the user group
                userIds:
                  type: array
                  items:
                    type: string
                  description: List of user IDs
              required:
                - name
                - userIds
      responses:
        '201':
          description: User group created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The ID of the newly created user group
                  userGroupId:
                    type: string
                    description: 'Deprecated: use `id` instead. The ID of the newly created user group.'
                    deprecated: true
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/user-groups/{id}:
    get:
      operationId: GetUserGroupByID
      tags:
        - User Groups
      summary: Returns a single user group by ID
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the user group to retrieve
          schema:
            type: string
      responses:
        '200':
          description: A single user group
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserGroup'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: User group not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    put:
      operationId: UpdateUserGroup
      tags:
        - User Groups
      summary: Updates a user group
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the user group to update
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                users:
                  type: array
                  items:
                    type: object
                    properties:
                      userId:
                        type: string
                        description: User ID
                      action:
                        type: string
                        enum:
                          - add
                          - remove
                        description: Action to perform (add or remove the user)
                    required:
                      - userId
                      - action
                  description: List of user updates
              required:
                - users
      responses:
        '200':
          description: User group updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The ID of the updated user group
                  userGroupId:
                    type: string
                    description: 'Deprecated: use `id` instead. The ID of the updated user group.'
                    deprecated: true
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: User group not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteUserGroup
      tags:
        - User Groups
      summary: Deletes a user group
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the user group to delete
          schema:
            type: string
      responses:
        '200':
          description: User group deleted successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The ID of the deleted user group
                  userGroupId:
                    type: string
                    description: 'Deprecated: use `id` instead. The ID of the deleted user group.'
                    deprecated: true
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: User group not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/applications:
    get:
      operationId: ListApplications
      tags:
        - Applications Read
      summary: Get all applications
      description: Fetches all application objects, with support for filtering and pagination.
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - in: query
          name: type
          schema:
            type: string
            enum:
              - custom
              - private
              - non-web
              - catalog
              - localdesktopcustom
              - localdesktopcatalog
          required: false
        - $ref: '#/components/parameters/nameParameter'
        - $ref: '#/components/parameters/urlParameter'
        - $ref: '#/components/parameters/includeCatalogAttributesParameter'
        - $ref: '#/components/parameters/limitParameter'
        - $ref: '#/components/parameters/cursorParameter'
        - $ref: '#/components/parameters/applicationSortParameter'
        - $ref: '#/components/parameters/orderParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: A list of all application objects
          content:
            application/json:
              schema:
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApplicationItem'
                  metadata:
                    $ref: '#/components/schemas/ResponseMetadata'
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /seb-api/v1/applications/type/{type}:
    get:
      operationId: ListApplicationsByType
      tags:
        - Applications Read
      summary: Get applications by type
      description: Fetches application objects belonging to a specific type.
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - $ref: '#/components/parameters/typeParameter'
        - in: query
          name: name
          schema:
            type: string
          description: Optional name to search in applications
          required: false
        - in: query
          name: url
          schema:
            type: string
          description: Optional URL to search in applications
          required: false
        - $ref: '#/components/parameters/includeCatalogAttributesParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
        - name: cursor
          in: query
          description: An optional opaque string that defines from where to start listing
          required: false
          schema:
            type: string
        - name: limit
          in: query
          description: Maximum number of applications to return
          required: false
          schema:
            type: integer
            format: int32
        - $ref: '#/components/parameters/applicationSortParameter'
        - name: order
          in: query
          description: The sort order
          required: false
          schema:
            $ref: '#/components/schemas/Order'
      responses:
        '200':
          description: A list of all application objects
          content:
            application/json:
              schema:
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApplicationItem'
                  metadata:
                    $ref: '#/components/schemas/ResponseMetadata'
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '500':
          description: Internal server error
    post:
      operationId: CreateApplication
      tags:
        - Applications Actions
      summary: Create an application
      description: |
        Adds a new application of the specified type to the management console.

        **URL Limit:** For custom, private, and non-web applications, there is a tenant-wide limit of 15,000 URLs combined. Exceeding this limit returns a 400 Bad Request error.
      parameters:
        - $ref: '#/components/parameters/createTypeParameter'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrReplaceAppInput'
      responses:
        '201':
          $ref: '#/components/responses/Created'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /seb-api/v1/applications/{id}:
    get:
      operationId: GetApplicationByID
      tags:
        - Applications Read
      summary: Get an application by ID
      description: Fetches a specific application object identified by its unique ID.
      parameters:
        - $ref: '#/components/parameters/applicationIdParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: An Application
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationItem'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
    delete:
      operationId: DeleteApplicationByID
      tags:
        - Applications Actions
      summary: Delete an application by ID
      description: Permanently removes a specific application identified by its ID.
      parameters:
        - $ref: '#/components/parameters/applicationIdParameter'
      responses:
        '204':
          $ref: '#/components/responses/Deleted'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /seb-api/v1/applications/bulk-delete:
    post:
      operationId: BulkDeleteApplications
      tags:
        - Applications Bulk
      summary: Delete multiple applications
      description: Permanently removes multiple applications identified by their IDs in a single atomic operation.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                appIds:
                  type: array
                  items:
                    type: string
                    pattern: ^0AP[0-9A-HJKMNP-TV-Z]{26}$
                  description: Array of application IDs to be deleted
                  minItems: 1
                  maxItems: 2000
              required:
                - appIds
      responses:
        '204':
          $ref: '#/components/responses/Deleted'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /seb-api/v1/applications/bulk-create/{type}:
    post:
      operationId: BulkCreateApplications
      tags:
        - Applications Bulk
      summary: Create multiple applications
      description: |
        Adds multiple new applications of the specified type to the management console in a single operation.

        **URL Limit:** For custom, private, and non-web applications, there is a tenant-wide limit of 15,000 URLs combined. Exceeding this limit returns a 400 Bad Request error.
      parameters:
        - $ref: '#/components/parameters/typeParameter'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/CreateOrReplaceAppInput'
              maxItems: 1000
              minItems: 1
      responses:
        '201':
          $ref: '#/components/responses/BulkCreated'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /seb-api/v1/applications/type/{type}/{id}:
    get:
      operationId: GetApplicationByTypeAndID
      tags:
        - Applications Read
      summary: Get an application by type and ID
      description: Fetches a specific application object belonging to the specified type.
      parameters:
        - $ref: '#/components/parameters/typeParameter'
        - $ref: '#/components/parameters/applicationIdParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: An Application
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationItem'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
    delete:
      operationId: DeleteApplicationByTypeAndID
      tags:
        - Applications Actions
      summary: Delete an application by type and ID
      description: Removes an application of the specified type from the system.
      parameters:
        - $ref: '#/components/parameters/typeParameter'
        - $ref: '#/components/parameters/applicationIdParameter'
      responses:
        '204':
          $ref: '#/components/responses/Deleted'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
    patch:
      operationId: PatchApplicationByTypeAndID
      tags:
        - Applications Actions
      summary: Update an application
      description: |
        Partially updates an application - provided attributes are set as specified, others remain unchanged.

        **URL Limit:** For custom, private, and non-web applications, there is a tenant-wide limit of 15,000 URLs combined. Exceeding this limit returns a 400 Bad Request error.
      parameters:
        - $ref: '#/components/parameters/typeParameter'
        - $ref: '#/components/parameters/applicationIdParameter'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchAppInput'
      responses:
        '200':
          $ref: '#/components/responses/Updated'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /seb-api/v1/application-groups:
    get:
      operationId: ListApplicationGroups
      tags:
        - Application Groups
      summary: Get all application groups
      description: Fetches all application groups with support for name-based filtering and sorting.
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
        - in: query
          name: name
          schema:
            type: string
          description: Optional name string to search in application groups
          required: false
        - in: query
          name: cursor
          description: An optional opaque string that defines from where to start listing
          required: false
          schema:
            type: string
        - in: query
          name: limit
          description: Number of application groups to return
          required: false
          schema:
            type: integer
            format: int32
        - $ref: '#/components/parameters/applicationGroupSortParameter'
        - in: query
          name: order
          description: The sort order
          required: false
          schema:
            $ref: '#/components/schemas/Order'
      responses:
        '200':
          description: A list of application group objects
          content:
            application/json:
              schema:
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/ApplicationGroup'
                  metadata:
                    $ref: '#/components/schemas/ResponseMetadata'
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '500':
          description: Internal server error
    post:
      operationId: CreateApplicationGroup
      tags:
        - Application Groups
      summary: Create an application group
      description: Defines a new group and associates it with a list of application IDs.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateOrReplaceAppGroupInput'
      responses:
        '201':
          $ref: '#/components/responses/Created'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /seb-api/v1/application-groups/{id}:
    get:
      operationId: GetApplicationGroupByID
      tags:
        - Application Groups
      summary: Get an application group
      description: Fetches a single application group by its unique ID.
      parameters:
        - $ref: '#/components/parameters/applicationGroupIdParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: An Application Group
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ApplicationGroup'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: Application Group Not found
        '500':
          description: Internal server error
    delete:
      operationId: DeleteApplicationGroupByID
      tags:
        - Application Groups
      summary: Delete an application group
      description: Permanently removes an application group identified by its ID.
      parameters:
        - $ref: '#/components/parameters/applicationGroupIdParameter'
      responses:
        '204':
          $ref: '#/components/responses/Deleted'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
    patch:
      operationId: PatchApplicationGroupByID
      tags:
        - Application Groups
      summary: Update an application group
      description: Partially updates an application group - provided attributes are set as specified, others remain unchanged.
      parameters:
        - $ref: '#/components/parameters/applicationGroupIdParameter'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchAppGroupInput'
      responses:
        '200':
          $ref: '#/components/responses/Updated'
        '400':
          $ref: '#/components/responses/BadRequest'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /seb-api/v1/applications/categories:
    get:
      operationId: ListApplicationCategories
      tags:
        - Applications Read
      summary: Get application categories
      responses:
        '200':
          description: A list of the available application categories
          content:
            application/json:
              schema:
                properties:
                  data:
                    type: array
                    items:
                      type: string
        '403':
          $ref: '#/components/responses/Forbidden'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /seb-api/v1/applications/plugins:
    get:
      operationId: ListApplicationPlugins
      tags:
        - Application Plugins
      summary: Get all application plugins
      responses:
        '200':
          description: A list of all application plugin objects
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/PluginResponse'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '500':
          description: Internal server error
  /seb-api/v1/applications/{id}/plugins:
    get:
      operationId: GetApplicationPlugin
      tags:
        - Application Plugins
      summary: Get an application plugin
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the application to retrieve the plugin for
          schema:
            type: string
      responses:
        '200':
          description: A single plugin associated with the application ID
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PluginResponse'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: Plugin not found
        '500':
          description: Internal server error
    post:
      operationId: CreateApplicationPlugin
      tags:
        - Application Plugins
      summary: Create an application plugin
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the application to create the plugin for
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                plugin:
                  $ref: '#/components/schemas/Plugin'
              required:
                - plugin
      responses:
        '201':
          description: Plugin created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  pluginId:
                    type: string
                    description: The ID of the newly created plugin
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '409':
          description: Conflict
        '500':
          description: Internal server error
    put:
      operationId: UpdateApplicationPlugin
      tags:
        - Application Plugins
      summary: Update an application plugin
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the application to update the plugin for
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                plugin:
                  $ref: '#/components/schemas/Plugin'
              required:
                - plugin
      responses:
        '200':
          description: Plugin updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  pluginId:
                    type: string
                    description: The ID of the updated plugin
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: Plugin not found
        '500':
          description: Internal server error
    delete:
      operationId: DeleteApplicationPlugin
      tags:
        - Application Plugins
      summary: Delete an application plugin
      parameters:
        - name: id
          in: path
          required: true
          description: The ID of the application associated with the plugin to delete
          schema:
            type: string
      responses:
        '200':
          description: Plugin deleted successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  pluginId:
                    type: string
                    description: The ID of the deleted plugin
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                type: object
                properties:
                  errorResponse:
                    $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
        '404':
          description: User group not found
        '500':
          description: Internal server error
  /seb-api/v1/device-groups:
    get:
      operationId: ListDeviceGroups
      tags:
        - Device Groups
      summary: Returns a list of device groups
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - name: limit
          in: query
          description: Number of device groups to return
          required: false
          schema:
            type: integer
            format: int32
        - name: deviceGroup.name
          in: query
          description: Filter by device group name
          required: false
          schema:
            type: string
        - name: deviceGroup.platform
          in: query
          description: Filter by device group platform
          required: false
          schema:
            $ref: '#/components/schemas/DeviceGroupPlatform'
        - name: deviceGroup.created_at_gte
          in: query
          description: Filter by created at time or after
          required: false
          schema:
            type: string
            format: date-time
        - name: deviceGroup.created_at_lte
          in: query
          description: Filter by created at time or before
          required: false
          schema:
            type: string
            format: date-time
        - name: deviceGroup.updated_at_gte
          in: query
          description: 'Filter by updated at time or after. Format: RFC3339 (e.g., "2023-03-29T00:00:00Z")'
          required: false
          schema:
            type: string
            format: date-time
        - name: deviceGroup.updated_at_lte
          in: query
          description: 'Filter by updated at time or before. Format: RFC3339 (e.g., "2023-03-29T23:59:59Z")'
          required: false
          schema:
            type: string
            format: date-time
        - name: cursor
          in: query
          description: An optional opaque string that defines from where to start listing
          required: false
          schema:
            type: string
        - name: sort
          in: query
          description: The field to sort by
          required: false
          schema:
            type: string
            enum:
              - deviceGroup.name
              - deviceGroup.platform
              - deviceGroup.created_at
              - deviceGroup.updated_at
        - name: order
          in: query
          description: The sort order
          required: false
          schema:
            $ref: '#/components/schemas/Order'
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: A list of device groups with pagination info
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/DeviceGroup'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    post:
      operationId: CreateDeviceGroup
      tags:
        - Device Groups
      summary: Create a new device group
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceGroupRequest'
      responses:
        '201':
          description: Device group created successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The ID of the newly created device group
                  deviceGroupId:
                    type: string
                    description: 'Deprecated: use `id` instead. The ID of the newly created device group.'
                    deprecated: true
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '409':
          description: Conflict - device group already exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/device-groups/{device-group-id}:
    get:
      operationId: GetDeviceGroupByID
      tags:
        - Device Groups
      summary: Returns a device group by ID
      parameters:
        - name: device-group-id
          in: path
          description: Device Group ID
          required: true
          schema:
            type: string
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: A device group
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeviceGroup'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Device group not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    put:
      operationId: UpdateDeviceGroup
      tags:
        - Device Groups
      summary: Replace entire device group
      description: Replaces the entire device group - missing attributes are disabled, provided attributes are set as specified.
      parameters:
        - name: device-group-id
          in: path
          required: true
          description: The ID of the device group to update
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceGroupRequest'
      responses:
        '200':
          description: Device group updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The ID of the updated device group
                  deviceGroupId:
                    type: string
                    description: 'Deprecated: use `id` instead. The ID of the updated device group.'
                    deprecated: true
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Device group not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchDeviceGroup
      tags:
        - Device Groups
      summary: Partially update device group
      description: Partially updates the device group - provided attributes are set as specified, others remain unchanged.
      parameters:
        - name: device-group-id
          in: path
          required: true
          description: The ID of the device group to update
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeviceGroupPatchRequest'
      responses:
        '200':
          description: Device group updated successfully
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The ID of the updated device group
                  deviceGroupId:
                    type: string
                    description: 'Deprecated: use `id` instead. The ID of the updated device group.'
                    deprecated: true
        '400':
          description: Bad request - invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Device group not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteDeviceGroup
      tags:
        - Device Groups
      summary: Deletes a device group
      parameters:
        - name: device-group-id
          in: path
          required: true
          description: The ID of the device group to delete
          schema:
            type: string
      responses:
        '204':
          description: Device group deleted successfully
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Device group not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/configuration-management/draft/publish:
    post:
      operationId: PublishDraftConfiguration
      tags:
        - Configuration Management
      summary: Publish Draft
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  type: string
                  description: Provide description to describe this version
                  maxLength: 255
      responses:
        '201':
          description: Active version was created successfully
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '409':
          description: 'Conflict - no Active version was created. `error.code` discriminates. CONFLICT: the draft contains no changes. PUBLISH_IN_PROGRESS: another publish or draft reset holds the draft lock, so nothing was published.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PublishConflictResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
        '501':
          description: Draft Mode is not supported
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotImplementedResponse'
  /seb-api/v1/configuration-management/draft/pending-changes:
    get:
      operationId: ListPendingChanges
      tags:
        - Configuration Management
      summary: List Pending Changes
      description: Returns everything currently pending in the draft - the entities modified since the last publish. A consumer calls this before publishing to see exactly what would be promoted. Always reports the draft version. An empty draft returns 200 with an empty collection.
      parameters:
        - name: limit
          in: query
          description: The maximum number of items to return. Used for pagination.
          required: false
          schema:
            type: integer
            format: int32
            minimum: 1
            maximum: 1000
            default: 100
        - name: cursor
          in: query
          description: An optional opaque string that defines from where to start listing.
          required: false
          schema:
            type: string
        - name: entityTypes
          in: query
          description: Filter to specific entity types. Repeat the parameter to filter by multiple values. Omit for all types.
          required: false
          style: form
          explode: true
          schema:
            type: array
            maxItems: 100
            items:
              $ref: '#/components/schemas/DraftEntityTypes'
        - name: lastUpdatedBy
          in: query
          description: Filter to changes last modified by a specific actor - an admin email or a service-account identifier. The special value "me" resolves to the calling identity. Omit for all actors.
          required: false
          schema:
            type: string
            maxLength: 320
      responses:
        '200':
          description: The list of pending draft changes.
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    description: An array of pending change objects for the page.
                    items:
                      $ref: '#/components/schemas/PendingChange'
                  metadata:
                    $ref: '#/components/schemas/ResponseMetadata'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
        '501':
          description: Draft mode is not supported
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnsupportedOperationResponse'
  /seb-api/v1/policy/sign-in:
    get:
      operationId: GetSignInPolicy
      tags:
        - Sign-In Overview
      summary: Get the Sign-In policy
      description: Fetches the complete sign-in policy, which is an ordered list of rules and sections.
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
        - $ref: '#/components/parameters/policyNameFilterParameter'
        - $ref: '#/components/parameters/policyIdsFilterParameter'
        - $ref: '#/components/parameters/policyModeFilterParameter'
        - $ref: '#/components/parameters/policyUsersFilterParameter'
        - $ref: '#/components/parameters/policyUserEmailsFilterParameter'
        - $ref: '#/components/parameters/policyUserGroupsFilterParameter'
        - $ref: '#/components/parameters/policyUsersExplicitOnlyFilterParameter'
        - $ref: '#/components/parameters/policyDeviceGroupsFilterParameter'
        - $ref: '#/components/parameters/policyDeviceGroupsExplicitOnlyFilterParameter'
        - $ref: '#/components/parameters/policySignInActionFilterParameter'
        - name: limit
          in: query
          description: The maximum number of items to return. Used for pagination
          required: false
          schema:
            type: integer
            format: int32
            minimum: 1
            maximum: 1000
            default: 100
        - $ref: '#/components/parameters/policyCursorParameter'
      responses:
        '200':
          description: Successfully retrieved the sign-in policy.
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    description: An array of Rule and Section objects for the page
                    items:
                      $ref: '#/components/schemas/RestrictedPolicyItem'
                  metadata:
                    $ref: '#/components/schemas/ResponseMetadata'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Policy version not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/sign-in/rules:
    post:
      operationId: CreateSignInRule
      tags:
        - Sign-In Rules
      summary: Create a Sign-In rule
      description: Creates a new sign-in rule in the policy. The rule is created in the draft configuration and must be published to become active.
      requestBody:
        description: The name, mode and action fields are required.
        required: true
        content:
          application/json:
            schema:
              type: object
              minProperties: 1
              required:
                - name
                - mode
                - action
              properties:
                name:
                  type: string
                  description: The name or title of the rule.
                  minLength: 1
                  maxLength: 300
                  pattern: \S
                description:
                  type: string
                  description: The detailed description of the rule.
                  maxLength: 300
                mode:
                  $ref: '#/components/schemas/RestrictedRuleMode'
                scope:
                  $ref: '#/components/schemas/PostScope'
                action:
                  $ref: '#/components/schemas/SignInRuleAction'
                positioning:
                  $ref: '#/components/schemas/PolicyPositioning'
              additionalProperties: false
      responses:
        '201':
          description: Successfully created the sign-in rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedIdResponse'
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/sign-in/rules/{id}:
    get:
      operationId: GetSignInRuleByID
      tags:
        - Sign-In Rules
      summary: Get a Sign-In rule
      description: Fetches a single, detailed sign-in rule object by its unique identifier. The response is structured into four sections general, scope, action, and metadata.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to retrieve
          schema:
            type: string
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: Successfully retrieved the sign-in rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SignInRuleDetailed'
        '400':
          description: Bad request - Invalid query parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Rule not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchSignInRuleByID
      tags:
        - Sign-In Rules
      summary: Update a Sign-In rule
      description: |
        Partially update a Sign-In rule object by its unique identifier. All fields are optional.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Partial rule fields to update. At least one field must be provided.
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/BasePatchRuleRequest'
                - type: object
                  properties:
                    mode:
                      $ref: '#/components/schemas/RestrictedRuleMode'
                    action:
                      $ref: '#/components/schemas/SignInRuleAction'
      responses:
        '200':
          description: Successfully updated the sign-in rule.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the rule to update.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Rule not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteSignInRuleByID
      tags:
        - Sign-In Rules
      summary: Delete a Sign-In rule
      description: |
        Delete a Sign-In rule object by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to delete.
          schema:
            $ref: '#/components/schemas/Pulid'
      responses:
        '204':
          description: Successfully deleted the sign-in rule.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Rule not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/sign-in/sections:
    post:
      operationId: CreateSignInSection
      tags:
        - Sign-In Sections
      summary: Create a Sign-In section
      description: Creates a new sign-in rule section. The section is created in the draft configuration and must be published to become active.
      requestBody:
        description: The positioning field is optional.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionPostRequest'
      responses:
        '201':
          description: Successfully created the sign-in section.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SectionDetailed'
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/security:
    get:
      operationId: GetSecurityPolicy
      tags:
        - Security Overview
      summary: Get the Security policy
      description: Fetches the complete security policy, which is an ordered list of rules and sections.
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
        - $ref: '#/components/parameters/policyNameFilterParameter'
        - $ref: '#/components/parameters/policyIdsFilterParameter'
        - $ref: '#/components/parameters/policyModeFilterParameter'
        - $ref: '#/components/parameters/policyUsersFilterParameter'
        - $ref: '#/components/parameters/policyUserEmailsFilterParameter'
        - $ref: '#/components/parameters/policyUserGroupsFilterParameter'
        - $ref: '#/components/parameters/policyUsersExplicitOnlyFilterParameter'
        - $ref: '#/components/parameters/policyDeviceGroupsFilterParameter'
        - $ref: '#/components/parameters/policyDeviceGroupsExplicitOnlyFilterParameter'
        - $ref: '#/components/parameters/policyControlsFilterParameter'
        - name: limit
          in: query
          description: The maximum number of items to return. Used for pagination
          required: false
          schema:
            type: integer
            format: int32
            minimum: 1
            maximum: 1000
            default: 100
        - $ref: '#/components/parameters/policyCursorParameter'
      responses:
        '200':
          description: Successfully retrieved the security policy.
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    description: An array of Rule and Section objects for the page
                    items:
                      $ref: '#/components/schemas/RestrictedPolicyItem'
                  metadata:
                    $ref: '#/components/schemas/ResponseMetadata'
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden. Endpoint not available or insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Policy version not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/security/sections:
    post:
      operationId: CreateSecuritySection
      tags:
        - Security Sections
      summary: Create a Security section
      description: Creates a new section for grouping security rules.
      requestBody:
        description: The positioning field is optional.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionPostRequest'
      responses:
        '201':
          description: Successfully created the security section.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SectionDetailed'
        '400':
          description: Bad request - Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/access-and-data:
    get:
      operationId: GetAccessAndDataPolicy
      tags:
        - Access and Data Overview
      summary: Get the Access and Data policy
      description: Fetches the complete access and data policy, which is an ordered list of rules and sections.
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
        - $ref: '#/components/parameters/policyNameFilterParameter'
        - $ref: '#/components/parameters/policyIdsFilterParameter'
        - $ref: '#/components/parameters/policyModeWithMonitorFilterParameter'
        - $ref: '#/components/parameters/policyUsersFilterParameter'
        - $ref: '#/components/parameters/policyUserEmailsFilterParameter'
        - $ref: '#/components/parameters/policyUserGroupsFilterParameter'
        - $ref: '#/components/parameters/policyUsersExplicitOnlyFilterParameter'
        - $ref: '#/components/parameters/policyDeviceGroupsFilterParameter'
        - $ref: '#/components/parameters/policyDeviceGroupsExplicitOnlyFilterParameter'
        - $ref: '#/components/parameters/policyApplicationsFilterParameter'
        - $ref: '#/components/parameters/policyApplicationsExplicitOnlyFilterParameter'
        - $ref: '#/components/parameters/policyApplicationGroupsFilterParameter'
        - $ref: '#/components/parameters/policyAnySaasApplicationFilterParameter'
        - $ref: '#/components/parameters/policyAnyPrivateApplicationFilterParameter'
        - $ref: '#/components/parameters/policyAnyRemoteApplicationFilterParameter'
        - $ref: '#/components/parameters/policyAnyLocalDesktopApplicationFilterParameter'
        - $ref: '#/components/parameters/policyLogLevelFilterParameter'
        - $ref: '#/components/parameters/policyHasDlpProfileFilterParameter'
        - $ref: '#/components/parameters/policyDlpProfileIdsFilterParameter'
        - $ref: '#/components/parameters/policyWebClassificationsFilterParameter'
        - $ref: '#/components/parameters/policyDataControlsFilterParameter'
        - $ref: '#/components/parameters/policyLoginControlsFilterParameter'
        - $ref: '#/components/parameters/policyWebAccessFilterParameter'
        - name: limit
          in: query
          description: The maximum number of items to return. Used for pagination
          required: false
          schema:
            type: integer
            format: int32
            minimum: 1
            maximum: 1000
            default: 100
        - $ref: '#/components/parameters/policyCursorParameter'
      responses:
        '200':
          description: Successfully retrieved the access and data policy.
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    description: An array of Rule and Section objects for the page
                    items:
                      $ref: '#/components/schemas/PolicyItem'
                  metadata:
                    $ref: '#/components/schemas/ResponseMetadata'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden. Endpoint not available or insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Policy version not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/access-and-data/sections:
    post:
      operationId: CreateAccessAndDataSection
      tags:
        - Access and Data Sections
      summary: Create an Access and Data section
      description: Creates a new section for grouping Access and Data rules.
      requestBody:
        description: The positioning field is optional.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionPostRequest'
      responses:
        '201':
          description: Successfully created the Access and Data section.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SectionDetailed'
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/sign-in/sections/{id}:
    get:
      operationId: GetSignInSectionByID
      tags:
        - Sign-In Sections
      summary: Get a Sign-In section
      description: Fetches a single sign-in rule section by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to retrieve (PULID format)
          schema:
            $ref: '#/components/schemas/Pulid'
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: Successfully retrieved the sign-in section.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SectionDetailed'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    put:
      operationId: UpdateSignInSectionByID
      tags:
        - Sign-In Sections
      summary: Replace a Sign-In section
      description: |
        Updates a sign-in rule section by its unique identifier. Only operates on sections of type signIn.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Section fields to update.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionUpdateRequest'
      responses:
        '200':
          description: Successfully updated the sign-in section.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated section.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchSignInSectionByID
      tags:
        - Sign-In Sections
      summary: Update a Sign-In section
      description: |
        Partially update a sign-in policy section by its unique identifier. All fields are optional; at least one must be provided. Supports updating the section name and/or repositioning the section within the policy. Only operates on sections of type signIn.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Partial section fields to update. At least one field must be provided.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionPatchRequest'
      responses:
        '200':
          description: Successfully updated the sign-in policy section.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated section.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteSignInSectionByID
      tags:
        - Sign-In Sections
      summary: Delete a Sign-In section
      description: |
        Delete a sign-in rule section by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the sign-in section to delete.
          schema:
            type: string
        - name: deleteRules
          in: query
          required: false
          description: |
            Controls what happens to rules in the section when it is deleted. When false (default), all rules in the section become standalone — they are detached from the section but not deleted. When true, non-default rules are deleted along with the section; default rules are detached.
          schema:
            type: boolean
            default: false
      responses:
        '204':
          description: Section successfully deleted. No response body is returned.
        '400':
          description: Bad request - Invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or endpoint not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section does not exist or belongs to a different tenant
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/access-and-data/sections/{id}:
    get:
      operationId: GetAccessAndDataSectionByID
      tags:
        - Access and Data Sections
      summary: Get an Access and Data section
      description: Fetches a single access and data rule section by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to retrieve (PULID format)
          schema:
            $ref: '#/components/schemas/Pulid'
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: Successfully retrieved the access and data section.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SectionDetailed'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    put:
      operationId: UpdateAccessAndDataSectionByID
      tags:
        - Access and Data Sections
      summary: Replace an Access and Data section
      description: |
        Updates an access-and-data rule section by its unique identifier. Only operates on sections of type accessAndData.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Section fields to update.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionUpdateRequest'
      responses:
        '200':
          description: Successfully updated the access-and-data section.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated section.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchAccessAndDataSectionByID
      tags:
        - Access and Data Sections
      summary: Update an Access and Data section
      description: |
        Partially update an access-and-data rule section by its unique identifier. All fields are optional; at least one must be provided. Supports updating the section name and/or repositioning the section within the policy. Only operates on sections of type accessAndData.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Partial section fields to update. At least one field must be provided.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionPatchRequest'
      responses:
        '200':
          description: Successfully updated the access-and-data section.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated section.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteAccessAndDataSectionByID
      tags:
        - Access and Data Sections
      summary: Delete an Access and Data section
      description: |
        Delete an access and data rule section by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the access and data section to delete.
          schema:
            type: string
        - name: deleteRules
          in: query
          required: false
          description: |
            Controls what happens to rules in the section when it is deleted. When false (default), all rules in the section become standalone — they are detached from the section but not deleted. When true, non-default rules are deleted along with the section; default rules are detached.
          schema:
            type: boolean
            default: false
      responses:
        '204':
          description: Section successfully deleted. No response body is returned.
        '400':
          description: Bad request - Invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or endpoint not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section does not exist or belongs to a different tenant
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/security/rules:
    post:
      operationId: CreateSecurityRule
      tags:
        - Security Rules
      summary: Create a Security rule
      description: Creates a new security rule in the policy. The rule is created in the draft configuration and must be published to become active. The controls object must contain at least one non-null control.
      requestBody:
        description: The name and mode fields are required.
        required: true
        content:
          application/json:
            schema:
              description: Request body for creating a Security Policy rule.
              allOf:
                - $ref: '#/components/schemas/BasePostRuleRequest'
                - type: object
                  required:
                    - controls
                  properties:
                    mode:
                      $ref: '#/components/schemas/RestrictedRuleMode'
                    controls:
                      $ref: '#/components/schemas/SecurityControls'
      responses:
        '201':
          description: Successfully created the security rule. Returns the resolved rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityResolvedRule'
        '400':
          description: Bad request - Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions, or a control included in the request is not available for this tenant because its feature is disabled. In the latter case the error message names the specific control, e.g. "remoteDebugging is not available for this tenant".
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
              example:
                error:
                  code: FORBIDDEN
                  message: remoteDebugging is not available for this tenant
                  timestamp: '2025-01-01T00:00:00Z'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/security/rules/{id}:
    get:
      operationId: GetSecurityRuleByID
      tags:
        - Security Rules
      summary: Get a Security rule
      description: Fetches a single, detailed security rule object by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to retrieve
          schema:
            type: string
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: Successfully retrieved the security rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityRuleDetailed'
        '400':
          description: Bad request - Invalid query parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Rule not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchSecurityRuleByID
      tags:
        - Security Rules
      summary: Update a Security rule
      description: |
        Partially update a Security rule object by its unique identifier. All fields are optional. When provided, the controls object must not be empty, and the update cannot remove the rule's last remaining control.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Partial rule fields to update. At least one field must be provided.
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/BasePatchRuleRequest'
                - type: object
                  properties:
                    mode:
                      $ref: '#/components/schemas/RestrictedRuleMode'
                    controls:
                      $ref: '#/components/schemas/SecurityControls'
      responses:
        '200':
          description: Successfully updated the security rule. Returns the rule ID.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated rule.
        '400':
          description: Bad request - Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions, or a control included in the request is not available for this tenant because its feature is disabled. In the latter case the error message names the specific control, e.g. "remoteDebugging is not available for this tenant".
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
              example:
                error:
                  code: FORBIDDEN
                  message: remoteDebugging is not available for this tenant
                  timestamp: '2025-01-01T00:00:00Z'
        '404':
          description: Not Found - Rule not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteSecurityRuleByID
      tags:
        - Security Rules
      summary: Delete a Security rule
      description: |
        Delete a Security rule object by its unique identifier. Only operates on rules of type security. Default rules cannot be deleted.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the security rule to delete.
          schema:
            $ref: '#/components/schemas/Pulid'
      responses:
        '204':
          description: Successfully deleted the security rule.
        '400':
          description: Bad request - Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or attempting to delete a default rule
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Rule not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/customization/rules:
    post:
      operationId: CreateCustomizationRule
      tags:
        - Customization Rules
      summary: Create a Customization rule
      description: Creates a new customization rule in the policy. The rule is created in the draft configuration and must be published to become active.
      requestBody:
        description: The name and mode fields are required.
        required: true
        content:
          application/json:
            schema:
              description: Request body for creating a Customization Policy rule.
              allOf:
                - $ref: '#/components/schemas/BasePostRuleRequest'
                - type: object
                  required:
                    - controls
                  properties:
                    mode:
                      $ref: '#/components/schemas/RestrictedRuleMode'
                    controls:
                      $ref: '#/components/schemas/CustomizationControls'
      responses:
        '201':
          description: Successfully created the customization rule. Returns the resolved rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomizationResolvedRule'
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions, or a control included in the request is not available for this tenant because its feature is disabled. In the latter case the error message names the specific control, e.g. "cachedSessionDuration is not available for this tenant".
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
              example:
                error:
                  code: FORBIDDEN
                  message: cachedSessionDuration is not available for this tenant
                  timestamp: '2025-01-01T00:00:00Z'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/customization/rules/{id}:
    get:
      operationId: GetCustomizationRuleByID
      tags:
        - Customization Rules
      summary: Get a Customization rule
      description: Fetches a single, detailed customization rule object by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to retrieve
          schema:
            type: string
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: Successfully retrieved the customization rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CustomizationRuleDetailed'
        '400':
          description: Bad request - Invalid query parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Rule not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchCustomizationRuleByID
      tags:
        - Customization Rules
      summary: Update a Customization rule
      description: |
        Partially update a Customization rule object by its unique identifier. All fields are optional.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Partial rule fields to update. At least one field must be provided.
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/BasePatchRuleRequest'
                - type: object
                  properties:
                    mode:
                      $ref: '#/components/schemas/RestrictedRuleMode'
                    controls:
                      $ref: '#/components/schemas/CustomizationControls'
      responses:
        '200':
          description: Successfully updated the customization rule. Returns the rule ID.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated rule.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions, or a control included in the request is not available for this tenant because its feature is disabled. In the latter case the error message names the specific control, e.g. "cachedSessionDuration is not available for this tenant".
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
              example:
                error:
                  code: FORBIDDEN
                  message: cachedSessionDuration is not available for this tenant
                  timestamp: '2025-01-01T00:00:00Z'
        '404':
          description: Not Found - Rule not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteCustomizationRuleByID
      tags:
        - Customization Rules
      summary: Delete a Customization rule
      description: |
        Delete a Customization rule object by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to delete.
          schema:
            $ref: '#/components/schemas/Pulid'
      responses:
        '204':
          description: Successfully deleted the customization rule.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Rule not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/customization:
    get:
      operationId: GetCustomizationPolicy
      tags:
        - Customization Overview
      summary: Get the Customization policy
      description: Fetches the complete customization policy, which is an ordered list of rules and sections.
      parameters:
        - $ref: '#/components/parameters/includeTotalCountParameter'
        - $ref: '#/components/parameters/configurationVersionParameter'
        - $ref: '#/components/parameters/policyNameFilterParameter'
        - $ref: '#/components/parameters/policyIdsFilterParameter'
        - $ref: '#/components/parameters/policyModeFilterParameter'
        - $ref: '#/components/parameters/policyUsersFilterParameter'
        - $ref: '#/components/parameters/policyUserEmailsFilterParameter'
        - $ref: '#/components/parameters/policyUserGroupsFilterParameter'
        - $ref: '#/components/parameters/policyUsersExplicitOnlyFilterParameter'
        - $ref: '#/components/parameters/policyDeviceGroupsFilterParameter'
        - $ref: '#/components/parameters/policyDeviceGroupsExplicitOnlyFilterParameter'
        - $ref: '#/components/parameters/policyControlsFilterParameter'
        - name: limit
          in: query
          description: The maximum number of items to return. Used for pagination
          required: false
          schema:
            type: integer
            format: int32
            minimum: 1
            maximum: 1000
            default: 100
        - $ref: '#/components/parameters/policyCursorParameter'
      responses:
        '200':
          description: Successfully retrieved the customization policy.
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    description: An array of Rule and Section objects for the page
                    items:
                      $ref: '#/components/schemas/RestrictedPolicyItem'
                  metadata:
                    $ref: '#/components/schemas/ResponseMetadata'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden. Endpoint not available or insufficient permissions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Policy version not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/customization/sections:
    post:
      operationId: CreateCustomizationSection
      tags:
        - Customization Sections
      summary: Create a Customization section
      description: Creates a new section for grouping customization rules.
      requestBody:
        description: The positioning field is optional.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionPostRequest'
      responses:
        '201':
          description: Successfully created the customization section.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SectionDetailed'
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/access-and-data/rules:
    post:
      operationId: CreateAccessAndDataRule
      tags:
        - Access and Data Rules
      summary: Create an Access and Data rule
      description: Creates a new access and data rule in the policy. The rule is created in the draft configuration and must be published to become active. When provided, the dataControls and loginControls objects must each contain at least one non-null control.
      requestBody:
        description: The name, mode and applications fields are required.
        required: true
        content:
          application/json:
            schema:
              description: Request body for creating an Access and Data Policy rule.
              allOf:
                - $ref: '#/components/schemas/BasePostRuleRequest'
                - type: object
                  required:
                    - applications
                    - access
                    - tracking
                  properties:
                    mode:
                      $ref: '#/components/schemas/RuleMode'
                    authenticationState:
                      $ref: '#/components/schemas/AuthenticationState'
                    applications:
                      $ref: '#/components/schemas/AccessAndDataPostApplications'
                    dataControls:
                      $ref: '#/components/schemas/AccessAndDataDataControls'
                    access:
                      $ref: '#/components/schemas/AccessInput'
                    loginControls:
                      allOf:
                        - $ref: '#/components/schemas/AccessAndDataLoginControlsInput'
                        - minProperties: 1
                    tracking:
                      $ref: '#/components/schemas/AccessAndDataTracking'
      responses:
        '201':
          description: Successfully created the access and data rule. Returns the resolved rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessAndDataResolvedRule'
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions, or a control included in the request is not available for this tenant because its feature is disabled. In the latter case the error message names the specific control that is unavailable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
              example:
                error:
                  code: FORBIDDEN
                  message: the requested control is not available for this tenant
                  timestamp: '2025-01-01T00:00:00Z'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/access-and-data/rules/{id}:
    get:
      operationId: GetAccessAndDataRuleByID
      tags:
        - Access and Data Rules
      summary: Get an Access and Data rule
      description: Fetches a single, detailed access-and-data rule object with controls sections by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to retrieve
          schema:
            type: string
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: Successfully retrieved the access-and-data rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AccessAndDataRuleDetailed'
        '400':
          description: Bad request - Invalid query parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Rule not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchAccessAndDataRuleByID
      tags:
        - Access and Data Rules
      summary: Update an Access and Data rule
      description: |
        Partially update an Access and Data rule object by its unique identifier. All fields are optional. When provided, the dataControls and loginControls objects must not be empty.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Partial rule fields to update. At least one field must be provided.
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/BasePatchRuleRequest'
                - type: object
                  properties:
                    mode:
                      $ref: '#/components/schemas/RuleMode'
                    authenticationState:
                      $ref: '#/components/schemas/AuthenticationState'
                    applications:
                      $ref: '#/components/schemas/AccessAndDataPatchApplications'
                    dataControls:
                      $ref: '#/components/schemas/AccessAndDataDataControls'
                    access:
                      $ref: '#/components/schemas/AccessInput'
                    loginControls:
                      $ref: '#/components/schemas/AccessAndDataLoginControlsInput'
                    tracking:
                      $ref: '#/components/schemas/AccessAndDataPatchTracking'
      responses:
        '200':
          description: Successfully updated the access and data rule. Returns the rule ID.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated rule.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions, or a control included in the request is not available for this tenant because its feature is disabled. In the latter case the error message names the specific control that is unavailable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
              example:
                error:
                  code: FORBIDDEN
                  message: the requested control is not available for this tenant
                  timestamp: '2025-01-01T00:00:00Z'
        '404':
          description: Not Found - Rule not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '409':
          $ref: '#/components/responses/Conflict'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteAccessAndDataRuleByID
      tags:
        - Access and Data Rules
      summary: Delete an Access and Data rule
      description: |
        Delete an Access and Data rule object by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the rule to delete.
          schema:
            $ref: '#/components/schemas/Pulid'
      responses:
        '204':
          description: Successfully deleted the access and data rule.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Rule not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/customization/sections/{id}:
    get:
      operationId: GetCustomizationSectionByID
      tags:
        - Customization Sections
      summary: Get a Customization section
      description: Fetches a single customization rule section by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to retrieve (PULID format)
          schema:
            $ref: '#/components/schemas/Pulid'
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: Successfully retrieved the customization section.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SectionDetailed'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    put:
      operationId: UpdateCustomizationSectionByID
      tags:
        - Customization Sections
      summary: Replace a Customization section
      description: |
        Updates a customization rule section by its unique identifier. Only operates on sections of type customization.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Section fields to update.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionUpdateRequest'
      responses:
        '200':
          description: Successfully updated the customization section.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated section.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchCustomizationSectionByID
      tags:
        - Customization Sections
      summary: Update a Customization section
      description: |
        Partially update a customization policy section by its unique identifier. All fields are optional; at least one must be provided. Supports updating the section name and/or repositioning the section within the policy. Only operates on sections of type customization.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Partial section fields to update. At least one field must be provided.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionPatchRequest'
      responses:
        '200':
          description: Successfully updated the customization policy section.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated section.
        '400':
          description: Bad request - Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteCustomizationSectionByID
      tags:
        - Customization Sections
      summary: Delete a Customization section
      description: |
        Delete a customization rule section by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the customization section to delete.
          schema:
            type: string
        - name: deleteRules
          in: query
          required: false
          description: |
            Controls what happens to rules in the section when it is deleted. When false (default), all rules in the section become standalone — they are detached from the section but not deleted. When true, non-default rules are deleted along with the section; default rules are detached.
          schema:
            type: boolean
            default: false
      responses:
        '204':
          description: Section successfully deleted. No response body is returned.
        '400':
          description: Bad request - Invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or endpoint not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section does not exist or belongs to a different tenant
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/security/sections/{id}:
    get:
      operationId: GetSecuritySectionByID
      tags:
        - Security Sections
      summary: Get a Security section
      description: Fetches a single security rule section by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to retrieve (PULID format)
          schema:
            $ref: '#/components/schemas/Pulid'
        - $ref: '#/components/parameters/configurationVersionParameter'
      responses:
        '200':
          description: Successfully retrieved the security section.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SectionDetailed'
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    put:
      operationId: UpdateSecuritySectionByID
      tags:
        - Security Sections
      summary: Replace a Security section
      description: |
        Updates a security rule section by its unique identifier. Only operates on sections of type security.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Section fields to update.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionUpdateRequest'
      responses:
        '200':
          description: Successfully updated the security section.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated section.
        '400':
          description: Bad request - Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchSecuritySectionByID
      tags:
        - Security Sections
      summary: Update a Security section
      description: |
        Partially update a security policy section by its unique identifier. All fields are optional; at least one must be provided. Supports updating the section name and/or repositioning the section within the policy. Only operates on sections of type security.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the section to update.
          schema:
            $ref: '#/components/schemas/Pulid'
      requestBody:
        description: Partial section fields to update. At least one field must be provided.
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SectionPatchRequest'
      responses:
        '200':
          description: Successfully updated the security policy section.
          content:
            application/json:
              schema:
                type: object
                properties:
                  id:
                    type: string
                    description: The unique identifier of the updated section.
        '400':
          description: Bad request - Invalid request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      operationId: DeleteSecuritySectionByID
      tags:
        - Security Sections
      summary: Delete a Security section
      description: |
        Delete a security rule section by its unique identifier.
      parameters:
        - name: id
          in: path
          required: true
          description: The unique identifier of the security section to delete.
          schema:
            type: string
        - name: deleteRules
          in: query
          required: false
          description: |
            Controls what happens to rules in the section when it is deleted. When false (default), all rules in the section become standalone — they are detached from the section but not deleted. When true, non-default rules are deleted along with the section; default rules are detached.
          schema:
            type: boolean
            default: false
      responses:
        '204':
          description: Section successfully deleted. No response body is returned.
        '400':
          description: Bad request - Invalid input.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or endpoint not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not Found - Section does not exist or belongs to a different tenant.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/sign-in/positions:
    put:
      operationId: UpdateSignInPositions
      tags:
        - Sign-In Positions
      summary: Reorder the Sign-In policy
      description: |
        Submits the full ordered list of rules and sections for the sign-in policy. Array index determines position (index 0 = highest priority, evaluated first). All existing rules and sections must be included. Rules in a section must be contiguous.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - positions
              properties:
                positions:
                  type: array
                  minItems: 1
                  description: |
                    Ordered list of all rules and sections. Array index determines position.
                  items:
                    $ref: '#/components/schemas/PositionItem'
              additionalProperties: false
      responses:
        '200':
          description: Successfully updated positions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PositionsSuccessResponse'
        '400':
          description: Bad request. error.code is one of VALIDATION_ERROR, FIELD_VALIDATION_ERROR, CONTIGUITY_VIOLATION, or INCOMPLETE_ARRAY; structured details vary by code.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not found. error.code is one of NOT_FOUND or FIELD_REFERENCE_NOT_FOUND.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchSignInPositions
      tags:
        - Sign-In Positions
      summary: Move rules or sections in the Sign-In policy
      description: |
        Submits an ordered list of moves. Each move repositions one rule or section into an
        explicit container (target.sectionId) using a position keyword (top/bottom/before/after)
        plus an optional anchor. Section subjects auto-carry their child rules in the same relative
        order. Default (baseline) rules are pinned at the bottom and cannot be moved or anchored on.
        All moves apply atomically; if any move fails, no DB changes or audit events are produced.
        The failing move's index is in the error details.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchPositionsRequest'
      responses:
        '200':
          description: Successfully applied all moves.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PositionsSuccessResponse'
        '400':
          description: Bad request. error.code is one of VALIDATION_ERROR, FIELD_VALIDATION_ERROR, CONTIGUITY_VIOLATION, or INCOMPLETE_ARRAY; structured details vary by code. For per-move field errors the failing move index is in details.errors[].index.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not found. error.code is one of NOT_FOUND or FIELD_REFERENCE_NOT_FOUND.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/access-and-data/positions:
    put:
      operationId: UpdateAccessAndDataPositions
      tags:
        - Access and Data Positions
      summary: Reorder the Access and Data policy
      description: |
        Submits the full ordered list of rules and sections for the access-and-data policy. Array index determines position (index 0 = highest priority, evaluated first). All existing rules and sections must be included. Rules in a section must be contiguous.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - positions
              properties:
                positions:
                  type: array
                  minItems: 1
                  description: |
                    Ordered list of all rules and sections. Array index determines position.
                  items:
                    $ref: '#/components/schemas/PositionItem'
              additionalProperties: false
      responses:
        '200':
          description: Successfully updated positions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PositionsSuccessResponse'
        '400':
          description: Bad request. error.code is one of VALIDATION_ERROR, FIELD_VALIDATION_ERROR, CONTIGUITY_VIOLATION, or INCOMPLETE_ARRAY; structured details vary by code.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not found. error.code is one of NOT_FOUND or FIELD_REFERENCE_NOT_FOUND.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchAccessAndDataPositions
      tags:
        - Access and Data Positions
      summary: Move rules or sections in the Access and Data policy
      description: |
        Submits an ordered list of moves. Each move repositions one rule or section into an
        explicit container (target.sectionId) using a position keyword (top/bottom/before/after)
        plus an optional anchor. Section subjects auto-carry their child rules in the same relative
        order. Default (baseline) rules are pinned at the bottom and cannot be moved or anchored on.
        All moves apply atomically; if any move fails, no DB changes or audit events are produced.
        The failing move's index is in the error details.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchPositionsRequest'
      responses:
        '200':
          description: Successfully applied all moves.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PositionsSuccessResponse'
        '400':
          description: Bad request. error.code is one of VALIDATION_ERROR, FIELD_VALIDATION_ERROR, CONTIGUITY_VIOLATION, or INCOMPLETE_ARRAY; structured details vary by code. For per-move field errors the failing move index is in details.errors[].index.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not found. error.code is one of NOT_FOUND or FIELD_REFERENCE_NOT_FOUND.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/customization/positions:
    put:
      operationId: UpdateCustomizationPositions
      tags:
        - Customization Positions
      summary: Reorder the Customization policy
      description: |
        Submits the full ordered list of rules and sections for the customization policy. Array index determines position (index 0 = highest priority, evaluated first). All existing rules and sections must be included. Rules in a section must be contiguous.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - positions
              properties:
                positions:
                  type: array
                  minItems: 1
                  description: |
                    Ordered list of all rules and sections. Array index determines position.
                  items:
                    $ref: '#/components/schemas/PositionItem'
              additionalProperties: false
      responses:
        '200':
          description: Successfully updated positions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PositionsSuccessResponse'
        '400':
          description: Bad request. error.code is one of VALIDATION_ERROR, FIELD_VALIDATION_ERROR, CONTIGUITY_VIOLATION, or INCOMPLETE_ARRAY; structured details vary by code.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not found. error.code is one of NOT_FOUND or FIELD_REFERENCE_NOT_FOUND.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchCustomizationPositions
      tags:
        - Customization Positions
      summary: Move rules or sections in the Customization policy
      description: |
        Submits an ordered list of moves. Each move repositions one rule or section into an
        explicit container (target.sectionId) using a position keyword (top/bottom/before/after)
        plus an optional anchor. Section subjects auto-carry their child rules in the same relative
        order. Default (baseline) rules are pinned at the bottom and cannot be moved or anchored on.
        All moves apply atomically; if any move fails, no DB changes or audit events are produced.
        The failing move's index is in the error details.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchPositionsRequest'
      responses:
        '200':
          description: Successfully applied all moves.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PositionsSuccessResponse'
        '400':
          description: Bad request. error.code is one of VALIDATION_ERROR, FIELD_VALIDATION_ERROR, CONTIGUITY_VIOLATION, or INCOMPLETE_ARRAY; structured details vary by code. For per-move field errors the failing move index is in details.errors[].index.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not found. error.code is one of NOT_FOUND or FIELD_REFERENCE_NOT_FOUND.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/policy/security/positions:
    put:
      operationId: UpdateSecurityPositions
      tags:
        - Security Positions
      summary: Reorder the Security policy
      description: |
        Submits the full ordered list of rules and sections for the security policy. Array index determines position (index 0 = highest priority, evaluated first). All existing rules and sections must be included. Rules in a section must be contiguous.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - positions
              properties:
                positions:
                  type: array
                  minItems: 1
                  description: |
                    Ordered list of all rules and sections. Array index determines position.
                  items:
                    $ref: '#/components/schemas/PositionItem'
              additionalProperties: false
      responses:
        '200':
          description: Successfully updated positions.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PositionsSuccessResponse'
        '400':
          description: Bad request. error.code is one of VALIDATION_ERROR, FIELD_VALIDATION_ERROR, CONTIGUITY_VIOLATION, or INCOMPLETE_ARRAY; structured details vary by code.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not found. error.code is one of NOT_FOUND or FIELD_REFERENCE_NOT_FOUND.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    patch:
      operationId: PatchSecurityPositions
      tags:
        - Security Positions
      summary: Move rules or sections in the Security policy
      description: |
        Submits an ordered list of moves. Each move repositions one rule or section into an
        explicit container (target.sectionId) using a position keyword (top/bottom/before/after)
        plus an optional anchor. Section subjects auto-carry their child rules in the same relative
        order. Default (baseline) rules are pinned at the bottom and cannot be moved or anchored on.
        All moves apply atomically; if any move fails, no DB changes or audit events are produced.
        The failing move's index is in the error details.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchPositionsRequest'
      responses:
        '200':
          description: Successfully applied all moves.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PositionsSuccessResponse'
        '400':
          description: Bad request. error.code is one of VALIDATION_ERROR, FIELD_VALIDATION_ERROR, CONTIGUITY_VIOLATION, or INCOMPLETE_ARRAY; structured details vary by code. For per-move field errors the failing move index is in details.errors[].index.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyBadRequestResponse'
        '403':
          description: Forbidden - Insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Not found. error.code is one of NOT_FOUND or FIELD_REFERENCE_NOT_FOUND.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PolicyNotFoundResponse'
        '500':
          description: Internal server error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/integrations/cloud-storage:
    get:
      tags:
        - Integrations
      summary: List all cloud storage providers
      description: Returns all configured cloud storage provider integrations with live connectivity status.
      responses:
        '200':
          description: List of cloud storage providers.
          content:
            application/json:
              schema:
                type: object
                required:
                  - providers
                properties:
                  providers:
                    type: array
                    items:
                      $ref: '#/components/schemas/CloudStorageProvider'
        '403':
          description: Forbidden - endpoint not enabled or insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    post:
      tags:
        - Integrations
      summary: Create a cloud storage provider
      description: |
        Creates a new cloud storage provider integration. Credentials are validated live against the provider before persisting. The type field determines which credential properties are required.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - displayName
                - type
              properties:
                displayName:
                  type: string
                  description: Human-readable name for the provider. Must be unique.
                  minLength: 1
                  maxLength: 30
                type:
                  $ref: '#/components/schemas/CloudStorageProviderType'
                microsoft:
                  $ref: '#/components/schemas/CreateMicrosoftProviderRequest'
                google:
                  $ref: '#/components/schemas/CreateGoogleProviderRequest'
              additionalProperties: false
      responses:
        '201':
          description: Provider created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudStorageProvider'
        '400':
          description: Bad request - missing required fields or invalid input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - endpoint not enabled or insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '409':
          description: Conflict - display name already exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ConflictResponse'
        '422':
          description: Credential validation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableEntityResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/integrations/cloud-storage/{providerId}:
    get:
      tags:
        - Integrations
      summary: Get a cloud storage provider by ID
      description: Returns a single cloud storage provider integration with live connectivity status.
      parameters:
        - name: providerId
          in: path
          required: true
          description: Unique identifier of the cloud storage provider.
          schema:
            type: string
      responses:
        '200':
          description: The cloud storage provider.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudStorageProvider'
        '403':
          description: Forbidden - endpoint not enabled or insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Provider not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    put:
      tags:
        - Integrations
      summary: Replace a cloud storage provider
      description: |
        Replaces a cloud storage provider's credentials. Used for credential rotation. Credentials are validated live before persisting. The provider type cannot be changed. All credential fields are required on every call.
      parameters:
        - name: providerId
          in: path
          required: true
          description: Unique identifier of the cloud storage provider.
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                microsoft:
                  $ref: '#/components/schemas/ReplaceMicrosoftProviderRequest'
                google:
                  $ref: '#/components/schemas/ReplaceGoogleProviderRequest'
              additionalProperties: false
      responses:
        '200':
          description: Provider replaced successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudStorageProvider'
        '400':
          description: Bad request - type field sent or missing required fields
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden - endpoint not enabled or insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Provider not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '422':
          description: Credential validation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnprocessableEntityResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
    delete:
      tags:
        - Integrations
      summary: Delete a cloud storage provider
      description: |
        Deletes a cloud storage provider integration. Returns 409 if the provider is referenced by policy rules.
      parameters:
        - name: providerId
          in: path
          required: true
          description: Unique identifier of the cloud storage provider.
          schema:
            type: string
      responses:
        '204':
          description: Provider deleted successfully.
        '403':
          description: Forbidden - endpoint not enabled or insufficient permissions
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Provider not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '409':
          description: Provider is in use by policy rules
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudStorageConflictResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/integrations/idp-application-sync:
    get:
      tags:
        - IDP Application Sync
      summary: List all IDP Application Sync providers
      description: Returns all configured IDP Application Sync provider integrations with live connectivity status.
      responses:
        '200':
          description: List of IDP Application Sync providers.
          content:
            application/json:
              schema:
                type: object
                required:
                  - providers
                properties:
                  providers:
                    type: array
                    items:
                      $ref: '#/components/schemas/IdpApplicationSyncProvider'
        '403':
          description: Forbidden - insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/integrations/idp-application-sync/{providerId}:
    get:
      tags:
        - IDP Application Sync
      summary: Get an IDP Application Sync provider by ID
      description: Returns a single IDP Application Sync provider integration with live connectivity status.
      parameters:
        - name: providerId
          in: path
          required: true
          description: Unique identifier of the IDP Application Sync provider.
          schema:
            type: string
            pattern: ^0IP[0-9A-HJKMNP-TV-Z]{26}$
      responses:
        '200':
          description: The IDP Application Sync provider.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdpApplicationSyncProvider'
        '403':
          description: Forbidden - insufficient permissions or feature not enabled
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Provider not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/assets/company-logo:
    post:
      operationId: uploadCompanyLogo
      tags:
        - Assets
      summary: Upload a company logo asset
      description: |
        Max size 1 MiB. Allowed extension: .png. Returns a `companyLogoId` to set on the
        `companyLogo` control's `companyLogoId` field.
        Note: SVG is not supported via the API (it requires a rasterized PNG companion that
        only the admin console can generate); upload an SVG company logo from the console.
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required:
                - file
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '201':
          description: Asset uploaded successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CompanyLogoUploadResponse'
        '400':
          description: Invalid file (wrong extension or validation failure)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '413':
          description: Request entity too large
  /seb-api/v1/assets/browser-icon:
    post:
      operationId: uploadBrowserIcon
      tags:
        - Assets
      summary: Upload a browser icon asset
      description: |
        Max size 3 MiB. Allowed extension: .png. Returns a `browserIconId` to set on
        the `browserIcon` control's `browserIconId` field.
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required:
                - file
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '201':
          description: Asset uploaded successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BrowserIconUploadResponse'
        '400':
          description: Invalid file (wrong extension or validation failure)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '413':
          description: Request entity too large
  /seb-api/v1/assets/background-image:
    post:
      operationId: uploadBackgroundImage
      tags:
        - Assets
      summary: Upload a background image asset
      description: |
        Max size 3 MiB. Allowed extensions: .png, .svg, .jpg, .jpeg. Returns a `backgroundImageId`
        to set on the `backgroundImage` control's `backgroundImageId` field. SVG uploads are sanitized.
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required:
                - file
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '201':
          description: Asset uploaded successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BackgroundImageUploadResponse'
        '400':
          description: Invalid file (wrong extension or validation failure)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '413':
          description: Request entity too large
  /seb-api/v1/assets/pac-file:
    post:
      operationId: uploadPacFile
      tags:
        - Assets
      summary: Upload a PAC file asset
      description: |
        Max size 2 MiB. Accepts .pac, .dat, .js, or extensionless filenames. Returns a
        `pacFileId` to set on the `proxyAutoConfigurationPacFile` control's `pacFileId` field.
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              required:
                - file
              properties:
                file:
                  type: string
                  format: binary
      responses:
        '201':
          description: Asset uploaded successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PacFileUploadResponse'
        '400':
          description: Invalid file (wrong extension or validation failure)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '413':
          description: Request entity too large
  /seb-api/v1/user-requests:
    get:
      tags:
        - User Requests
      summary: List user requests
      parameters:
        - name: limit
          in: query
          description: Number of user requests to return
          required: false
          schema:
            type: integer
            format: int32
        - name: request.type
          in: query
          description: Filter by request type
          required: false
          schema:
            type: string
            enum:
              - WebAccess
              - AppLogin
        - name: request.user_id
          in: query
          description: Filter by request user id
          required: false
          schema:
            type: string
        - name: request.device_id
          in: query
          description: Filter by request device id
          required: false
          schema:
            type: string
        - name: request.rule_id
          in: query
          description: Filter by request rule id
          required: false
          schema:
            type: string
        - name: request.url
          in: query
          description: Filter by request url
          required: false
          schema:
            type: string
        - name: request.responded_by
          in: query
          description: Filter by response by user id
          required: false
          schema:
            type: string
        - name: request.status
          in: query
          description: Filter by request status
          required: false
          schema:
            type: string
            enum:
              - Approved
              - Declined
              - Pending
              - Revoked
        - name: cursor
          in: query
          description: An optional opaque string that defines from where to start listing
          required: false
          schema:
            type: string
        - name: sort
          in: query
          description: The field to sort by
          required: false
          schema:
            type: string
            enum:
              - request.created_at
              - request.type
              - request.status
              - request.response_time
              - request.url
        - name: order
          in: query
          description: The sort order
          required: false
          schema:
            $ref: '#/components/schemas/Order'
      responses:
        '200':
          description: A list of requests with pagination info
          content:
            application/json:
              schema:
                type: object
                properties:
                  pageInfo:
                    $ref: '#/components/schemas/PageInfo'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/UserRequest'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/user-requests/{id}:
    get:
      tags:
        - User Requests
      summary: Get a user request
      parameters:
        - name: id
          in: path
          description: Request ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: A request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserRequest'
        '404':
          description: Request not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/user-requests/{id}/action:
    post:
      tags:
        - User Requests
      summary: Act on a user request
      parameters:
        - name: id
          in: path
          description: Request ID
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RequestAction'
      responses:
        '200':
          description: Action performed on request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserRequest'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
  /seb-api/v1/user-requests/{id}/revoke:
    post:
      tags:
        - User Requests
      summary: Revoke a user request
      parameters:
        - name: id
          in: path
          description: Request ID
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevokeRequestAction'
      responses:
        '200':
          description: Action performed on request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserRequest'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ForbiddenResponse'
        '404':
          description: Request not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotFoundResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalErrorResponse'
components:
  parameters:
    applicationGroupIdParameter:
      name: id
      in: path
      required: true
      schema:
        type: string
        pattern: ^0AG[0-9A-HJKMNP-TV-Z]{26}$
      description: Application Group ID.
    applicationGroupSortParameter:
      in: query
      name: sort
      description: The field to sort by
      required: false
      schema:
        type: string
        enum:
          - application_group.id
          - application_group.name
          - application_group.create_time
          - application_group.update_time
    applicationIdParameter:
      name: id
      in: path
      required: true
      schema:
        type: string
        pattern: ^0AP[0-9A-HJKMNP-TV-Z]{26}$
      description: Application ID.
    applicationSortParameter:
      in: query
      name: sort
      description: The field to sort by
      required: false
      schema:
        type: string
        enum:
          - application.id
          - application.name
          - application.create_time
          - application.update_time
    configurationVersionParameter:
      name: configurationVersion
      in: query
      description: Configuration version to retrieve (draft, active, or version number)
      required: false
      schema:
        type: string
        default: draft
        pattern: ^([dD]raft|[aA]ctive|[1-9][0-9]{0,9}|0CV[0-9A-Z]{26})$
    createTypeParameter:
      in: path
      name: type
      required: true
      description: |
        Application type to create. Only creatable types are accepted; the read-only `catalog` and `localdesktopcatalog` types cannot be created.
      schema:
        type: string
        enum:
          - custom
          - private
          - non-web
          - localdesktopcustom
    cursorParameter:
      name: cursor
      in: query
      description: An optional opaque string that defines from where to start listing
      required: false
      schema:
        type: string
    includeCatalogAttributesParameter:
      in: query
      name: includeCatalogAttributes
      schema:
        type: boolean
        default: false
      description: Whether to include catalog_attributes in catalog application results
      required: false
    includeTotalCountParameter:
      name: includeTotalCount
      in: query
      description: Populate pageInfo.totalCount with the total number of items matching the query across all pages. Defaults to true on the first page (no cursor) and false on subsequent pages; set explicitly to override.
      required: false
      schema:
        type: boolean
    limitParameter:
      name: limit
      in: query
      description: Maximum number of applications to return
      required: false
      schema:
        type: integer
        format: int32
    nameParameter:
      in: query
      name: name
      schema:
        type: string
      description: Optional name to search in applications
      required: false
    orderParameter:
      name: order
      in: query
      description: The sort order
      required: false
      schema:
        $ref: '#/components/schemas/Order'
    policyAnyLocalDesktopApplicationFilterParameter:
      name: anyLocalDesktopApplication
      in: query
      description: Filter access-and-data policy rules by whether they apply to any local desktop application.
      required: false
      schema:
        type: boolean
    policyAnyPrivateApplicationFilterParameter:
      name: anyPrivateApplication
      in: query
      description: Filter access-and-data policy rules by whether they apply to any private application.
      required: false
      schema:
        type: boolean
    policyAnyRemoteApplicationFilterParameter:
      name: anyRemoteApplication
      in: query
      description: Filter access-and-data policy rules by whether they apply to any remote application.
      required: false
      schema:
        type: boolean
    policyAnySaasApplicationFilterParameter:
      name: anySaasApplication
      in: query
      description: Filter access-and-data policy rules by whether they apply to any internet and SaaS application.
      required: false
      schema:
        type: boolean
    policyApplicationGroupsFilterParameter:
      name: applicationGroup
      in: query
      description: Filter access-and-data policy rules by public application group ID. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          maxLength: 40
    policyApplicationsExplicitOnlyFilterParameter:
      name: applicationExplicitOnly
      in: query
      description: When true, the application filter matches only rules that explicitly list the selected applications or their application groups, excluding any-application and default rules.
      required: false
      schema:
        type: boolean
    policyApplicationsFilterParameter:
      name: application
      in: query
      description: Filter access-and-data policy rules by public application ID. Repeat the parameter to filter by multiple values. By default, this includes rules that apply to any internet and SaaS application, default rules, direct application scope, and application-group membership. Use applicationExplicitOnly=true to exclude rules that apply to any internet and SaaS application and default rules.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          maxLength: 40
    policyControlsFilterParameter:
      name: control
      in: query
      description: Filter security or customization policy rules by public control key. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          enum:
            - pdfium
            - advancedBrowserProtection
            - adminMessages
            - allowedOrBlockedExtensions
            - allowedPrinters
            - authenticationFactor
            - authenticationServerAllowlist
            - autoLaunchExternalApplications
            - automaticClientCertificateSelection
            - backgroundImage
            - basicAuthenticationOverHttp
            - blockExtensionsByPermissions
            - thirdPartyCookies
            - brandColor
            - cookiesProtection
            - browserHistory
            - browserIcon
            - browserLock
            - browserSelfProtection
            - cast
            - companyLogo
            - companyName
            - concurrentNumberOfDevices
            - cookies
            - autofillOfCreditCards
            - customBrowserPreferences
            - customHttpHeader
            - customNotice
            - customProfilePreferences
            - customTexts
            - defaultSearchProvider
            - deploymentUpgrade
            - desktopSharing
            - developerToolsForExtensions
            - dnsOverHttps
            - enhancedTrackingProtection
            - enterpriseBrowserPolicies
            - extensionForceInstall
            - fileSystemApi
            - flushBrowserData
            - forceHttps
            - autofillOfForms
            - googleCloudPrint
            - hideSensitiveDataFromExtensions
            - historyCollection
            - homePage
            - identityProviderSyncedShortcuts
            - incognito
            - internalNetworkDetection
            - internetExplorerCompatibilityMode
            - javaScriptV8JitAndWebAssembly
            - javaScriptRunningFromOmnibox
            - kerberosDelegationAllowlist
            - keyloggingProtection
            - launchingExternalApplications
            - legacyPasswordManager
            - localFonts
            - localNetworkAccessRestrictions
            - managedShortcuts
            - microsoftAutoSso
            - nativeMessagingHosts
            - newTabPage
            - notifications
            - onBrowserStartup
            - onboardingWizard
            - openLinksInExternalApps
            - pageTranslationGoogleTranslate
            - pagesWithInsecureContent
            - pagesWithSslErrors
            - mobilePasswordSaving
            - popups
            - postQuantumKeySecurity
            - printPreview
            - prismaBrowserDesktopExtender
            - profileSync
            - proxyAutoConfigurationPacFile
            - quicProtocol
            - realUserMonitoring
            - remoteDebugging
            - remoteHostFirewallTraversal
            - requestDesktopMobileSite
            - restrictExtensionHostPermissions
            - searchEngineContentFiltering
            - searchSuggestions
            - sensorsApi
            - sessionRefresh
            - sidebar
            - strictOriginIsolation
            - suggestDefaultBrowser
            - endProcessViaTaskManager
            - themeColor
            - trafficFlow
            - trustedCertificateAuthorities
            - userAgent
            - userDataDirectoryProtection
            - webBluetoothApi
            - webClipboardApi
            - webGlApi
            - webHidApi
            - webRtc
            - webSerialApi
            - webUsbApi
    policyCursorParameter:
      name: cursor
      in: query
      description: An optional opaque string that defines from where to start listing.
      required: false
      schema:
        type: string
        maxLength: 256
    policyDataControlsFilterParameter:
      name: dataControl
      in: query
      description: Filter access-and-data policy rules by public data-control key. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          enum:
            - camera
            - clipboard
            - developerToolsOnWebPages
            - fileProtection
            - genAIPrompt
            - livePageScanning
            - maliciousFileProtection
            - microphone
            - print
            - readOnlyWebpage
            - screenshot
            - typingGuard
            - webUserInteraction
            - webpageDataMasking
            - webpageWatermarking
    policyDeviceGroupsExplicitOnlyFilterParameter:
      name: deviceGroupExplicitOnly
      in: query
      description: When true, the deviceGroup filter matches only rules that explicitly list the selected device groups, excluding default rules.
      required: false
      schema:
        type: boolean
    policyDeviceGroupsFilterParameter:
      name: deviceGroup
      in: query
      description: Filter policy rules by public device group ID. Repeat the parameter to filter by multiple values. By default, this includes default rules. Use deviceGroupExplicitOnly=true to match only direct device group scope.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          maxLength: 40
    policyDlpProfileIdsFilterParameter:
      name: dlpProfileId
      in: query
      description: Filter access-and-data policy rules by EDLP data-profile ID. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          maxLength: 64
    policyHasDlpProfileFilterParameter:
      name: hasDlpProfile
      in: query
      description: Filter access-and-data policy rules by whether an EDLP data profile is configured.
      required: false
      schema:
        type: boolean
    policyIdsFilterParameter:
      name: id
      in: query
      description: Filter policy rules by public rule ID. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          maxLength: 40
    policyLogLevelFilterParameter:
      name: logLevel
      in: query
      description: Filter access-and-data policy rules by tracking log level. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 10
        items:
          $ref: '#/components/schemas/AccessAndDataLogLevel'
    policyLoginControlsFilterParameter:
      name: loginControl
      in: query
      description: Filter access-and-data policy rules by public login-control key. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 10
        items:
          type: string
          enum:
            - formLogin
            - idpLogin
            - passkeyLogin
            - socialLogin
    policyModeFilterParameter:
      name: mode
      in: query
      description: Filter policy rules by mode. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 10
        items:
          $ref: '#/components/schemas/RestrictedRuleMode'
    policyModeWithMonitorFilterParameter:
      name: mode
      in: query
      description: Filter policy rules by mode. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 10
        items:
          $ref: '#/components/schemas/RuleMode'
    policyNameFilterParameter:
      name: name
      in: query
      description: Filter policy rules by rule name. Matches rule names that contain this value, case-insensitive.
      required: false
      schema:
        type: string
        maxLength: 255
    policySignInActionFilterParameter:
      name: action
      in: query
      description: Filter sign-in policy rules by sign-in action effect. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 10
        items:
          $ref: '#/components/schemas/SignInRuleAction'
    policyUserEmailsFilterParameter:
      name: userEmail
      in: query
      description: Filter policy rules by user email (exact match). Repeat the parameter to filter by multiple values. Behaves like the user filter but identifies users by email, combined with any user/userGroup values; userExplicitOnly applies to it as well.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          maxLength: 320
    policyUserGroupsFilterParameter:
      name: userGroup
      in: query
      description: Filter policy rules by public user group ID. Repeat the parameter to filter by multiple values. By default, this includes any-scope rules. Use userExplicitOnly=true to match only direct user or user group scope.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          maxLength: 40
    policyUsersExplicitOnlyFilterParameter:
      name: userExplicitOnly
      in: query
      description: When true, the user/userGroup filter matches only rules that explicitly list the selected users or user groups, excluding any-scope rules and user-group membership expansion.
      required: false
      schema:
        type: boolean
    policyUsersFilterParameter:
      name: user
      in: query
      description: Filter policy rules by public user ID. Repeat the parameter to filter by multiple values. By default, this includes any-scope rules and rules scoped to user groups that contain the user. Use userExplicitOnly=true to match only direct user or user group scope. Reserved value "anonymous" matches pre-login rules.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          type: string
          maxLength: 40
    policyWebAccessFilterParameter:
      name: webAccess
      in: query
      description: Filter access-and-data policy rules by web-access control effect. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 10
        items:
          $ref: '#/components/schemas/AccessAction'
    policyWebClassificationsFilterParameter:
      name: webClassification
      in: query
      description: Filter access-and-data policy rules by web classification. Repeat the parameter to filter by multiple values.
      required: false
      style: form
      explode: true
      schema:
        type: array
        maxItems: 100
        items:
          $ref: '#/components/schemas/WebClassification'
    typeParameter:
      in: path
      name: type
      required: true
      schema:
        type: string
        enum:
          - custom
          - private
          - non-web
          - catalog
          - localdesktopcustom
          - localdesktopcatalog
    urlParameter:
      in: query
      name: url
      schema:
        type: string
      description: Optional URL to search in applications
      required: false
  responses:
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            type: object
            properties:
              errorResponse:
                $ref: '#/components/schemas/ErrorResponse'
    BulkCreated:
      description: Created successfully
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/BulkCreatedResponse'
    Conflict:
      description: Conflict - request conflicts with the current resource state
      content:
        application/json:
          schema:
            type: object
            properties:
              errorResponse:
                $ref: '#/components/schemas/ErrorResponse'
    Created:
      description: Created successfully
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/CreatedIdResponse'
    Deleted:
      description: Deleted successfully
    Forbidden:
      description: Forbidden
    InternalServerError:
      description: Internal server error
    NotFound:
      description: Resource Not found
    Updated:
      description: Updated successfully
      content:
        application/json:
          schema:
            type: object
            properties:
              id:
                type: string
                description: The ID of the updated resource
            required:
              - id
  schemas:
    AccessAction:
      title: AccessAction
      type: string
      description: Top-level web-access decision for an access-and-data rule.
      enum:
        - allow
        - block
        - prompt
        - redirect
    AccessAndDataApplications:
      title: AccessAndDataApplications
      description: Applications scope for an access-and-data rule, categorized by application type.
      type: object
      required:
        - saas
        - private
        - nonWeb
        - localDesktop
        - applicationGroups
      properties:
        saas:
          type: object
          description: SaaS application scope
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - any
                - specific
              description: Whether this rule applies to no, any, or specific SaaS apps
            specific:
              type: object
              description: Present when accessMode is specific
              properties:
                applicationIds:
                  type: array
                  items:
                    $ref: '#/components/schemas/ApplicationRef'
                urls:
                  type: array
                  uniqueItems: true
                  items:
                    type: string
                webClassifications:
                  $ref: '#/components/schemas/WebClassifications'
        private:
          type: object
          description: Private application scope
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - any
                - specific
              description: Whether this rule applies to no, any, or specific private apps
            specific:
              type: object
              description: Present when accessMode is specific
              properties:
                applicationIds:
                  type: array
                  items:
                    $ref: '#/components/schemas/ApplicationRef'
        nonWeb:
          type: object
          description: Non-web (remote connections) application scope
          required:
            - accessMode
          properties:
            accessMode:
              $ref: '#/components/schemas/NonWebAccessMode'
            allowManualConnection:
              type: boolean
              description: Allow users to connect to any non-web app via Manual Connect
            specific:
              type: object
              description: Present when accessMode is specific
              properties:
                applicationIds:
                  type: array
                  items:
                    $ref: '#/components/schemas/ApplicationRef'
        localDesktop:
          type: object
          description: Local desktop application scope (Windows only)
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - any
                - specific
              description: Whether this rule applies to no, any defined, or specific local desktop apps
            specific:
              type: object
              description: Present when accessMode is specific
              properties:
                applicationIds:
                  type: array
                  items:
                    $ref: '#/components/schemas/ApplicationRef'
        applicationGroups:
          type: object
          description: Application group scope
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - specific
              description: Whether this rule applies to no or specific application groups
            specific:
              type: object
              description: Present when accessMode is specific
              properties:
                applicationGroupIds:
                  type: array
                  items:
                    $ref: '#/components/schemas/ApplicationGroupRef'
        tenantConditions:
          $ref: '#/components/schemas/TenantConditions'
    AccessAndDataDataControls:
      title: AccessAndDataDataControls
      type: object
      description: |-
        Data controls for access-and-data rules.

        Each data control supports a specific set of data-profile content types (no profile,
        on-device scanning, or cloud-assisted scanning). When a rule links a data profile
        (an EDLP `dlpProfileId`) or uses inline content, controls that are not supported for the
        resulting content type are rejected with HTTP 400. Set `bypassDlpProfileValidation: true`
        to suppress content-agnostic compatibility rejections only — those controls save
        successfully but become runtime no-ops. Controls that are entirely unsupported for the
        resulting content type are always rejected, even when bypass is enabled.
      minProperties: 1
      additionalProperties: false
      properties:
        developerToolsOnWebPages:
          description: Control DevTools to avoid potential data leaks, inspecting page content, and running unauthorized code in the console.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        camera:
          description: Control the ability to use camera in web pages.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        microphone:
          description: Control the ability to use microphone in web pages.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        screenshot:
          $ref: '#/components/schemas/ScreenshotControl'
        webUserInteraction:
          $ref: '#/components/schemas/WebUserInteractionControl'
        readOnlyWebpage:
          $ref: '#/components/schemas/FormSubmissionControl'
        livePageScanning:
          $ref: '#/components/schemas/LivePageScanningControl'
        webpageWatermarking:
          $ref: '#/components/schemas/WatermarkControl'
        clipboard:
          $ref: '#/components/schemas/ClipboardControl'
        typingGuard:
          $ref: '#/components/schemas/SanitizingContentControl'
        maliciousFileProtection:
          $ref: '#/components/schemas/MaliciousFileProtectionControl'
        webpageDataMasking:
          $ref: '#/components/schemas/WebpageDataMaskingControl'
        genAIPrompt:
          $ref: '#/components/schemas/GenAIPromptControl'
        print:
          $ref: '#/components/schemas/PrintControl'
        dlpProfileId:
          description: |
            Enterprise DLP (EDLP) data profile id (the same value returned by EDLP GET /v2/api/data-profiles). Write-only on POST/PATCH; reads return dlpProfile instead. Send null on PATCH to unlink the rule from any EDLP profile.
          type: string
          nullable: true
          maxLength: 64
          writeOnly: true
        dlpProfile:
          description: |
            Expanded EDLP profile reference returned on GET. Present only when the rule is linked to an EDLP profile.
          readOnly: true
          $ref: '#/components/schemas/DlpProfileRef'
        bypassDlpProfileValidation:
          description: |
            Bypass the content-agnostic data-profile compatibility check for controls in this object. When false (default), controls incompatible with the configured dlpProfileId are rejected with HTTP 400. When true, the rule saves and content-agnostic incompatible controls become runtime no-ops. Controls entirely unsupported for the resulting content type are always rejected, even when this is true.
          type: boolean
          default: false
          writeOnly: true
        fileProtection:
          $ref: '#/components/schemas/FileProtectionControl'
    AccessAndDataEvidenceType:
      title: AccessAndDataEvidenceType
      type: string
      description: Evidence capture type for access and data tracking. Only applicable when logLevel is 'enhanced'.
      enum:
        - screenshots
        - eventRecording
    AccessAndDataLogLevel:
      title: AccessAndDataLogLevel
      type: string
      description: Log privacy level for access and data tracking.
      enum:
        - 'off'
        - anonymized
        - 'on'
        - enhanced
    AccessAndDataLoginControlsInput:
      title: AccessAndDataLoginControlsInput
      type: object
      description: Login controls for access-and-data rules.
      properties:
        formLogin:
          $ref: '#/components/schemas/FormLoginControl'
        passkeyLogin:
          $ref: '#/components/schemas/PasskeyLoginControl'
        idpLogin:
          description: Control identity-provider (SSO/SAML) logins via Prisma Browser.
          allOf:
            - $ref: '#/components/schemas/IdpLoginControl'
        socialLogin:
          description: Control consumer social login (OAuth) providers via Prisma Browser.
          allOf:
            - $ref: '#/components/schemas/SocialLoginControl'
    AccessAndDataPatchApplications:
      title: AccessAndDataPatchApplications
      description: |
        Applications scope for patching an access-and-data rule. Each segment is optional. Scalar fields (accessMode, allowManualConnection) are set directly. List fields support full replacement (e.g. applicationIds) or delta via addApplicationIds/removeApplicationIds.
      type: object
      additionalProperties: false
      minProperties: 1
      properties:
        saas:
          type: object
          additionalProperties: false
          description: SaaS application scope
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - any
                - specific
              description: Whether this rule applies to no, any, or specific SaaS apps
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              minProperties: 1
              properties:
                applicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Full replacement list of application IDs
                addApplicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application IDs to add to the current list
                removeApplicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application IDs to remove from the current list
                urls:
                  description: Full replacement list of URLs
                  $ref: '#/components/schemas/UrlsInput'
                addUrls:
                  description: URLs to add to the current list
                  $ref: '#/components/schemas/UrlsInput'
                removeUrls:
                  description: URLs to remove from the current list
                  $ref: '#/components/schemas/UrlsInput'
                webClassifications:
                  allOf:
                    - $ref: '#/components/schemas/WebClassifications'
                    - description: Full replacement list of web classifications
                addWebClassifications:
                  allOf:
                    - $ref: '#/components/schemas/WebClassifications'
                    - description: Web classifications to add to the current list
                removeWebClassifications:
                  allOf:
                    - $ref: '#/components/schemas/WebClassifications'
                    - description: Web classifications to remove from the current list
        private:
          type: object
          additionalProperties: false
          description: Private application scope
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - any
                - specific
              description: Whether this rule applies to no, any, or specific private apps
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              minProperties: 1
              properties:
                applicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Full replacement list of application IDs
                addApplicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application IDs to add to the current list
                removeApplicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application IDs to remove from the current list
        nonWeb:
          type: object
          additionalProperties: false
          description: Non-web (remote connections) application scope
          required:
            - accessMode
          properties:
            accessMode:
              $ref: '#/components/schemas/NonWebAccessMode'
            allowManualConnection:
              type: boolean
              description: Allow users to connect to any non-web app via Manual Connect
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              minProperties: 1
              properties:
                applicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Full replacement list of application IDs
                addApplicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application IDs to add to the current list
                removeApplicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application IDs to remove from the current list
        localDesktop:
          type: object
          additionalProperties: false
          description: Local desktop application scope (Windows only)
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - any
                - specific
              description: Whether this rule applies to no, any defined, or specific local desktop apps
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              minProperties: 1
              properties:
                applicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Full replacement list of application IDs
                addApplicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application IDs to add to the current list
                removeApplicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application IDs to remove from the current list
        applicationGroups:
          type: object
          additionalProperties: false
          description: Application group references
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - specific
              description: Whether this rule applies to no or specific application groups
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              minProperties: 1
              properties:
                applicationGroupIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Full replacement list of application group IDs
                addApplicationGroupIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application group IDs to add to the current list
                removeApplicationGroupIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                    - description: Application group IDs to remove from the current list
        tenantConditions:
          $ref: '#/components/schemas/TenantConditions'
    AccessAndDataPatchTracking:
      title: AccessAndDataPatchTracking
      description: Tracking and logging configuration for patching a rule. All fields are optional; only provided fields are updated (per-field merge).
      type: object
      minProperties: 1
      additionalProperties: false
      properties:
        logLevel:
          $ref: '#/components/schemas/AccessAndDataLogLevel'
        shouldLogQueryParams:
          type: boolean
          description: Whether to log URL query parameters. Only applicable when logLevel is 'on'.
        evidenceType:
          $ref: '#/components/schemas/AccessAndDataEvidenceType'
        sessionRecording:
          type: boolean
          description: Whether session recording is enabled
        shouldLogGenAiPrompt:
          type: boolean
          description: Whether to include the text of prompts submitted by users to Gen AI applications. Only present when logLevel is on or enhanced. Requires the genAIPrompt data control.
        dataSnippet:
          type: boolean
          description: Whether to capture data snippets from content scanning. Only present when logLevel is on or enhanced and a data profile is linked. Enabling it requires a linked data profile, supplied as the write-only dlpProfileId field (reads return dlpProfile instead). Enabling it is not applicable when access.action is 'block'.
        evidenceStorage:
          type: boolean
          description: Whether to store evidence from content scanning. Only present when logLevel is on or enhanced and a data profile is linked. Enabling it requires a linked data profile, supplied as the write-only dlpProfileId field (reads return dlpProfile instead). Enabling it is not applicable when access.action is 'block'.
    AccessAndDataPostApplications:
      title: AccessAndDataPostApplications
      description: Applications scope for creating an access-and-data rule, categorized by application type.
      type: object
      additionalProperties: false
      minProperties: 1
      properties:
        saas:
          type: object
          additionalProperties: false
          description: SaaS application scope
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - any
                - specific
              description: Whether this rule applies to no, any, or specific SaaS apps
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              minProperties: 1
              properties:
                applicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
                urls:
                  $ref: '#/components/schemas/UrlsInput'
                webClassifications:
                  $ref: '#/components/schemas/WebClassifications'
        private:
          type: object
          additionalProperties: false
          description: Private application scope
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - any
                - specific
              description: Whether this rule applies to no, any, or specific private apps
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              required:
                - applicationIds
              properties:
                applicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
        nonWeb:
          type: object
          additionalProperties: false
          description: Non-web (remote connections) application scope
          required:
            - accessMode
          properties:
            accessMode:
              $ref: '#/components/schemas/NonWebAccessMode'
            allowManualConnection:
              type: boolean
              description: Allow users to connect to any non-web app via Manual Connect
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              required:
                - applicationIds
              properties:
                applicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
        localDesktop:
          type: object
          additionalProperties: false
          description: Local desktop application scope (Windows only)
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - any
                - specific
              description: Whether this rule applies to no, any defined, or specific local desktop apps
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              required:
                - applicationIds
              properties:
                applicationIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
        applicationGroups:
          type: object
          additionalProperties: false
          description: Application group references
          required:
            - accessMode
          properties:
            accessMode:
              type: string
              enum:
                - none
                - specific
              description: Whether this rule applies to no or specific application groups
            specific:
              type: object
              additionalProperties: false
              description: Present when accessMode is specific
              required:
                - applicationGroupIds
              properties:
                applicationGroupIds:
                  allOf:
                    - $ref: '#/components/schemas/PulidArray'
                    - minItems: 1
        tenantConditions:
          $ref: '#/components/schemas/TenantConditions'
    AccessAndDataResolvedRule:
      title: AccessAndDataResolvedRule
      description: The resolved desired state of an Access and Data rule, returned by create (POST 201) and full-replace (PUT 200). It mirrors the request body with all server-resolved defaults filled in, plus the assigned id. References are returned as IDs, not enriched with names; use GET-by-id for the enriched entity.
      type: object
      required:
        - id
        - name
        - mode
        - applications
        - access
        - tracking
      properties:
        id:
          type: string
          description: Unique identifier of the rule (PULID, 29 chars). In draft mode this is the entity ID.
          example: 0RL0123456789012345678901234
        name:
          type: string
          description: The name or title of the rule.
        description:
          type: string
          description: The detailed description of the rule.
        scope:
          $ref: '#/components/schemas/PostScope'
        mode:
          $ref: '#/components/schemas/RuleMode'
        authenticationState:
          $ref: '#/components/schemas/AuthenticationState'
        applications:
          $ref: '#/components/schemas/AccessAndDataPostApplications'
        dataControls:
          $ref: '#/components/schemas/AccessAndDataDataControls'
        access:
          $ref: '#/components/schemas/AccessInput'
        loginControls:
          $ref: '#/components/schemas/AccessAndDataLoginControlsInput'
        tracking:
          $ref: '#/components/schemas/AccessAndDataTracking'
    AccessAndDataRuleDetailed:
      title: AccessAndDataRuleDetailed
      description: A detailed access-and-data rule object with complete configuration
      type: object
      required:
        - id
        - name
        - priority
        - mode
        - scope
        - applications
        - access
        - tracking
        - metadata
      properties:
        id:
          type: string
          description: Unique identifier for the rule
        name:
          type: string
          description: User-friendly name for the rule
        priority:
          type: integer
          format: int32
          description: Order position of the rule in the list
        section:
          type: object
          nullable: true
          description: Section this rule belongs to (null if standalone)
          allOf:
            - $ref: '#/components/schemas/SectionRef'
        description:
          type: string
          description: Detailed explanation of the rule's purpose
        mode:
          $ref: '#/components/schemas/AccessAndDataRuleMode'
        authenticationState:
          description: |
            Present and set to `unauthenticated` for pre-login rules. Omitted for standard (authenticated) rules.
          allOf:
            - $ref: '#/components/schemas/AuthenticationState'
        scope:
          $ref: '#/components/schemas/GetScope'
        applications:
          $ref: '#/components/schemas/AccessAndDataApplications'
        access:
          $ref: '#/components/schemas/AccessInput'
        loginControls:
          $ref: '#/components/schemas/AccessAndDataLoginControlsInput'
        dataControls:
          $ref: '#/components/schemas/AccessAndDataDataControls'
        controlSet:
          readOnly: true
          description: |
            Reference to the shared control set (policy profile) this rule's controls are inherited from. Present only when the rule links a shared control set.
          allOf:
            - $ref: '#/components/schemas/ControlSetRef'
        tracking:
          $ref: '#/components/schemas/AccessAndDataTracking'
        metadata:
          type: object
          required:
            - createdBy
            - createdTime
            - lastUpdatedBy
            - lastUpdatedTime
          properties:
            configurationVersion:
              $ref: '#/components/schemas/MetadataConfigurationVersion'
            createdBy:
              readOnly: true
              type: string
              description: Email or identifier of the admin who created the rule
            createdTime:
              readOnly: true
              type: string
              format: date-time
              description: Timestamp when the rule was created
            lastUpdatedBy:
              readOnly: true
              type: string
              description: Email or identifier of the admin who last updated the rule
            lastUpdatedTime:
              readOnly: true
              type: string
              format: date-time
              description: Timestamp when the rule was last updated
    AccessAndDataRuleMode:
      title: AccessAndDataRuleMode
      type: string
      description: The mode of the rule.
      enum:
        - active
        - monitor
        - disabled
    AccessAndDataTracking:
      title: AccessAndDataTracking
      description: Tracking and logging configuration for the rule
      type: object
      required:
        - logLevel
      properties:
        logLevel:
          $ref: '#/components/schemas/AccessAndDataLogLevel'
        shouldLogQueryParams:
          type: boolean
          description: Whether to log URL query parameters. Only applicable when logLevel is 'on'.
        evidenceType:
          $ref: '#/components/schemas/AccessAndDataEvidenceType'
        sessionRecording:
          type: boolean
          description: Whether session recording is enabled
          default: false
        shouldLogGenAiPrompt:
          type: boolean
          description: Whether to include the text of prompts submitted by users to Gen AI applications. Only present when logLevel is on or enhanced. Requires the genAIPrompt data control.
        dataSnippet:
          type: boolean
          description: Whether to capture data snippets from content scanning. Only present when logLevel is on or enhanced and a data profile is linked. Enabling it requires a linked data profile, supplied as the write-only dlpProfileId field (reads return dlpProfile instead). Enabling it is not applicable when access.action is 'block'.
        evidenceStorage:
          type: boolean
          description: Whether to store evidence from content scanning. Only present when logLevel is on or enhanced and a data profile is linked. Enabling it requires a linked data profile, supplied as the write-only dlpProfileId field (reads return dlpProfile instead). Enabling it is not applicable when access.action is 'block'.
    AccessInput:
      title: AccessInput
      description: |
        Access control configuration for an access-and-data rule.

        Note: on PATCH, the `access` block uses replace semantics — clients must
        re-send the full object on every update. Any field omitted is cleared
        (with the exception of fields that are not part of this schema, such as
        `authMethod`, which is preserved from the existing rule).
      type: object
      required:
        - action
      additionalProperties: false
      properties:
        action:
          $ref: '#/components/schemas/AccessAction'
        userPrompt:
          description: |
            How the user is prompted before access is granted. Only valid when action is 'prompt'.
            When omitted at action=prompt.
          $ref: '#/components/schemas/AccessUserPrompt'
        customDialogText:
          description: Custom text shown on the block page. Only valid when action is 'block'.
          $ref: '#/components/schemas/CustomDialogText'
        enforceRedirect:
          description: Redirect configuration. Required when action is 'redirect'; not valid for other actions.
          $ref: '#/components/schemas/EnforceRedirect'
        enforceRedirectDialogText:
          description: Custom text shown on the redirect transition page. Only valid when action is 'redirect'.
          $ref: '#/components/schemas/CustomDialogText'
        mfaRequired:
          description: Whether the user must complete an MFA challenge before access is granted.
          $ref: '#/components/schemas/MfaRequired'
        authenticationDurationMinutes:
          description: How often the user is re-prompted for MFA. '0' means every time. Only valid when mfaRequired is true.
          $ref: '#/components/schemas/OverrideDurationMinutes'
        openInPrismaBrowser:
          description: Enforce the Extension to Prisma Browser handoff for matched traffic.
          $ref: '#/components/schemas/OpenInPrismaBrowser'
        addressBarLabel:
          type: string
          description: Label shown in the browser address bar for matched pages.
          enum:
            - policy
            - personal
            - business
            - risky
            - sensitive
            - noLabel
            - custom
        customLabel:
          description: Required when addressBarLabel is 'custom'.
          $ref: '#/components/schemas/CustomLabel'
        webpageFrame:
          description: Colored frame around the webpage indicating a regulated or classified environment. Including this object enables the frame; omitting it disables it.
          $ref: '#/components/schemas/WebpageFrame'
    AccessUserPrompt:
      title: AccessUserPrompt
      description: How an end user is prompted before access is granted, and how long their decision is remembered.
      type: object
      required:
        - mode
      additionalProperties: false
      properties:
        mode:
          type: string
          description: What the user sees when the access restriction triggers.
          enum:
            - none
            - warnAndAllow
            - proceedWithReason
            - adminApproval
          default: warnAndAllow
        durationMinutes:
          type: string
          description: How long the user's decision is remembered. Only valid when mode is not 'none'. When mode is adminApproval and this field is omitted, the server defaults to '540' (9 hours), matching the dashboard UI default.
          enum:
            - '0'
            - '10'
            - '60'
            - '240'
            - '540'
            - '720'
            - '1440'
            - '4320'
            - '10080'
            - '20160'
            - '43200'
            - '86400'
            - '129600'
    AddRemoveApps:
      title: AddRemoveApps
      type: object
      properties:
        add:
          type: array
          items:
            type: string
            pattern: ^0AP[0-9A-HJKMNP-TV-Z]{26}$
          maxItems: 2000
        remove:
          type: array
          items:
            type: string
            pattern: ^0AP[0-9A-HJKMNP-TV-Z]{26}$
          maxItems: 2000
    AddRemoveCidrs:
      title: AddRemoveCidrs
      type: object
      description: Add or remove CIDRs from a private application.
      properties:
        add:
          type: array
          items:
            type: string
          maxItems: 100
        remove:
          type: array
          items:
            type: string
    AddRemoveTagIDs:
      type: object
      description: Add or remove custom tags from the application.
      properties:
        add:
          type: array
          items:
            type: string
            pattern: ^0TG[0-9A-HJKMNP-TV-Z]{26}$
          maxItems: 63
        remove:
          type: array
          items:
            type: string
            pattern: ^0TG[0-9A-HJKMNP-TV-Z]{26}$
          maxItems: 63
    AddRemoveUrls:
      title: AddRemoveUrls
      type: object
      description: Add or remove URLs from an application. The total URL count after modification cannot exceed 15000.
      properties:
        add:
          type: array
          items:
            $ref: '#/components/schemas/UrlInput'
          maxItems: 15000
        remove:
          type: array
          items:
            $ref: '#/components/schemas/UrlInput'
          maxItems: 15000
    AdminMessagesControl:
      title: AdminMessagesControl
      type: object
      nullable: true
      description: Control whether admin messages appear on the new tab page.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether admin messages appear on the new tab page
          enum:
            - enabled
            - disabled
        messages:
          type: array
          description: Custom admin messages appearing on the new tab page
          minItems: 1
          maxItems: 10
          items:
            type: object
            additionalProperties: false
            required:
              - title
              - description
            properties:
              title:
                type: string
                description: Message title displayed on the new tab page
                minLength: 1
                maxLength: 80
                pattern: \S
              description:
                type: string
                description: Message body displayed on the new tab page
                minLength: 1
                maxLength: 1000
                pattern: \S
              externalLink:
                type: string
                description: Optional URL linked from the message. Must be provided together with externalLinkName.
                minLength: 1
                maxLength: 2000
                pattern: \S
              externalLinkName:
                type: string
                description: Optional link name for the message URL. Must be provided together with externalLink.
                minLength: 1
                maxLength: 15
                pattern: \S
    AdminSidebarManagementControl:
      type: object
      nullable: true
      description: Configure the browser sidebar visibility and managed sidebar shortcuts.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether the sidebar is enabled for end users
          enum:
            - enable
            - disable
        shortcuts:
          type: array
          description: |
            Managed sidebar shortcuts shown in the browser sidebar.
            Must not be set when action is disable. At most 12 entries are allowed; requests that exceed this cap are rejected with HTTP 400.
          minItems: 1
          maxItems: 12
          items:
            type: object
            additionalProperties: false
            required:
              - name
              - url
            properties:
              name:
                type: string
                description: Display name of the sidebar shortcut
                minLength: 1
                maxLength: 256
                pattern: \S
              url:
                type: string
                description: Destination URL for the sidebar shortcut
                minLength: 1
                maxLength: 2048
                pattern: \S
              shortcutIconId:
                type: string
                description: Icon asset identifier for the sidebar shortcut. Icons can currently be uploaded via the management console; a dedicated PAPI upload endpoint is planned.
                maxLength: 100
              openInSideview:
                type: boolean
                description: Whether the shortcut opens in side view by default rather than full view
    AllowBlockControl:
      title: AllowBlockControl
      type: object
      nullable: true
      description: A simple control with an allow or block action. Re-usable by any data control that only needs a binary allow/block decision.
      required:
        - action
      properties:
        action:
          type: string
          description: The action for this control.
          enum:
            - allow
            - block
    AllowedOrBlockedExtensionsControl:
      title: AllowedOrBlockedExtensionsControl
      type: object
      nullable: true
      description: Control browser extension availability to users based on extension ID or risk score.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Operating mode for Allowed or Blocked Extensions. When multiple rules match a user, higher-priority allowAll or blockAll rules override lower-priority extension rules, and allowByList allows only the listed extensions.
          enum:
            - allowAll
            - blockAll
            - allowByList
            - blockByListOrRisk
        extensions:
          type: array
          description: List of Chrome extension entries to allow or block.
          maxItems: 1000
          items:
            type: object
            additionalProperties: false
            required:
              - id
            properties:
              id:
                type: string
                description: Chrome extension ID.
                minLength: 32
                maxLength: 32
                pattern: ^[a-p]{32}$
        riskLevel:
          type: string
          description: Risk level threshold.
          enum:
            - malicious
            - medium
            - high
    AllowedPrintersControl:
      title: AllowedPrintersControl
      type: object
      nullable: true
      description: Control which printers can be used when printing from Prisma Browser.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether any printer is allowed or only specific printers from a list.
          enum:
            - allowAny
            - allowSpecific
        allowedPrinters:
          type: array
          description: List of allowed printer identifiers.
          maxItems: 1000
          uniqueItems: true
          items:
            type: string
            minLength: 1
            maxLength: 2048
            pattern: \S
        allowSaveAsPdf:
          type: boolean
          default: true
          description: Whether to allow 'Save as PDF' as a print option.
    ApplicationGroup:
      title: ApplicationGroup
      type: object
      properties:
        id:
          type: string
          description: Unique identifier
        name:
          type: string
          description: Name of the application group
        description:
          type: string
          description: Description of the application group
        applications:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                description: Unique identifier
              name:
                type: string
                description: Name of the application
              type:
                type: string
                description: The type of the application
                enum:
                  - catalog
                  - custom
                  - private
                  - non-web
                  - user-non-web
                  - pra
                  - desktop
            required:
              - id
              - name
              - type
          description: IDs of the group members
        metadata:
          $ref: '#/components/schemas/metadata'
      required:
        - id
        - name
        - metadata
    ApplicationGroupRef:
      title: ApplicationGroupRef
      type: object
      description: A reference to an application group entity.
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: Application group identifier
        name:
          type: string
          description: Application group display name
    ApplicationItem:
      title: ApplicationItem
      type: object
      oneOf:
        - $ref: '#/components/schemas/CustomApplication'
        - $ref: '#/components/schemas/PrivateApplication'
        - $ref: '#/components/schemas/NonWebApplication'
        - $ref: '#/components/schemas/CatalogApplication'
        - $ref: '#/components/schemas/LocalDesktopCustomApplication'
        - $ref: '#/components/schemas/LocalDesktopCatalogApplication'
      discriminator:
        propertyName: type
        mapping:
          custom: '#/components/schemas/CustomApplication'
          private: '#/components/schemas/PrivateApplication'
          non-web: '#/components/schemas/NonWebApplication'
          catalog: '#/components/schemas/CatalogApplication'
          localdesktopcustom: '#/components/schemas/LocalDesktopCustomApplication'
          localdesktopcatalog: '#/components/schemas/LocalDesktopCatalogApplication'
    ApplicationRef:
      title: ApplicationRef
      type: object
      description: A reference to an application entity.
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: Application identifier
        name:
          type: string
          description: Application display name
        appType:
          type: string
          enum:
            - localDesktopCatalog
            - localDesktopCustom
          description: Whether the app is from catalog or admin-defined
    ApplicationTypeInput:
      title: ApplicationTypeInput
      type: string
      enum:
        - custom
        - private
        - non-web
        - localdesktopcustom
    ArchiveDevicesBadRequestResponse:
      description: Error envelope returned for 400 Bad Request from ArchiveDevices. The error.code discriminates which validation failed.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          oneOf:
            - $ref: '#/components/schemas/InvalidDeviceIdError'
            - $ref: '#/components/schemas/InvalidStatusTransitionError'
          discriminator:
            propertyName: code
            mapping:
              INVALID_DEVICE_ID: '#/components/schemas/InvalidDeviceIdError'
              INVALID_STATUS_TRANSITION: '#/components/schemas/InvalidStatusTransitionError'
    AttributeObject:
      title: AttributeObject
      type: object
      properties:
        screenLock:
          type: object
          description: Check if the device has automatic screen lock enabled
          properties:
            negate:
              type: boolean
              default: false
              description: Whether to negate this attribute
            enabled:
              type: boolean
              description: Whether this attribute is enabled
          required:
            - enabled
        endpointProtection:
          type: object
          description: Check if the device has endpoint protection software installed and running
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            selectedVendors:
              type: array
              items:
                $ref: '#/components/schemas/EppVendorName'
              description: Selected endpoint protection vendors to check for
            lastDefinitionUpdate:
              $ref: '#/components/schemas/LastDefinitionUpdateAttribute'
          required:
            - enabled
        firewall:
          type: object
          description: Check if the device has firewall protection installed and running
          properties:
            negate:
              type: boolean
              default: false
              description: Whether to negate this attribute
            enabled:
              type: boolean
              description: Whether this attribute is enabled
            anyVendor:
              type: boolean
              description: Whether to accept any firewall vendor
            specificVendors:
              type: array
              items:
                $ref: '#/components/schemas/FirewallVendorName'
              description: Selected firewall vendors to check for
          required:
            - enabled
        diskEncryption:
          type: object
          description: Check if the device has disk encryption software installed and running
          properties:
            negate:
              type: boolean
              default: false
              description: Whether to negate this attribute
            enabled:
              type: boolean
              description: Whether this attribute is enabled
            anyVendor:
              type: boolean
              description: Whether to accept any disk encryption vendor
            specificVendors:
              type: array
              items:
                $ref: '#/components/schemas/DiskEncryptionVendorName'
              description: Selected disk encryption vendors to check for
          required:
            - enabled
        osVersion:
          type: object
          description: Check if the device is running a specific operating system version
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            windows:
              $ref: '#/components/schemas/WindowsVersionAttribute'
            macOS:
              $ref: '#/components/schemas/MacOSVersionAttribute'
            linux:
              $ref: '#/components/schemas/LinuxVersionAttribute'
          required:
            - enabled
        serialNumber:
          type: object
          description: Check if the device's serial number is included in the provided list
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            serials:
              type: array
              items:
                type: string
              description: List of device serial numbers to check for
          required:
            - enabled
        clientCertificate:
          type: object
          description: Check if the device's client certificate is signed by the provided issuer certificate
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            issuerCertificates:
              type: array
              items:
                $ref: '#/components/schemas/IssuerCertificate'
              description: List of trusted issuer certificates to validate against
          required:
            - enabled
        deviceType:
          type: object
          description: Check if the device matches specific device types (e.g., desktop, laptop, virtual machine)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            types:
              type: array
              items:
                $ref: '#/components/schemas/DeviceType'
              description: List of device types to check for
          required:
            - enabled
        csZtaScore:
          type: object
          description: |
            Check if the device meets minimum CrowdStrike Zero Trust Assessment score requirements. 
            If multiple score types are provided (basicScore, overallScore, breakdownScores), the latest one will be used.
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            basicScore:
              $ref: '#/components/schemas/CsZtaBasicScoreLevel'
            overallScore:
              $ref: '#/components/schemas/CsZtaScore'
            breakdownScores:
              type: object
              description: Breakdown scores with separate OS and sensor score ranges for granular validation.
              properties:
                osScore:
                  $ref: '#/components/schemas/CsZtaScore'
                sensorScore:
                  $ref: '#/components/schemas/CsZtaScore'
              required:
                - osScore
                - sensorScore
            customerIds:
              type: array
              items:
                type: string
              description: CrowdStrike customer IDs to validate
          required:
            - enabled
        mobileRootJailBreakStatus:
          type: object
          description: Check if the mobile device has been rooted (Android) or jailbroken (iOS)
          properties:
            enabled:
              type: boolean
          required:
            - enabled
        mobileScreenLock:
          type: object
          description: Check if the mobile device has screen lock protection enabled
          properties:
            enabled:
              type: boolean
          required:
            - enabled
        mobileDeviceManufacturers:
          type: object
          description: Check if the mobile device is from specific manufacturers (e.g., Apple, Samsung)
          properties:
            enabled:
              type: boolean
            vendors:
              type: array
              items:
                $ref: '#/components/schemas/MobileManufacturer'
              description: List of mobile device manufacturers to check for
          required:
            - enabled
        mobileOsVersion:
          type: object
          description: Check if the mobile device is running a specific iOS or Android version
          properties:
            enabled:
              type: boolean
            ios:
              $ref: '#/components/schemas/MobileOsVersion'
            android:
              $ref: '#/components/schemas/MobileOsVersion'
          required:
            - enabled
        mobileDeviceType:
          type: object
          description: Check if the mobile device matches specific types (e.g., phone, tablet)
          properties:
            enabled:
              type: boolean
            types:
              type: array
              items:
                $ref: '#/components/schemas/MobileDeviceType'
              description: List of mobile device types to check for
          required:
            - enabled
        mobileDeviceManagement:
          type: object
          description: Check if the mobile device is managed by specific mobile device management systems
          properties:
            enabled:
              type: boolean
            systems:
              type: array
              items:
                $ref: '#/components/schemas/MobileDeviceManagementSystem'
              description: Mobile device management system configurations
          required:
            - enabled
        osPassword:
          type: object
          description: Check if the device has an OS authentication password configured with specific requirements
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            complexity:
              $ref: '#/components/schemas/OsPasswordComplexity'
            maxAge:
              type: integer
              description: Maximum password age in days
            minLength:
              type: integer
              description: Minimum password length in characters
          required:
            - enabled
        normalOSBootMode:
          type: object
          description: Check if a device is running in OS normal boot mode (not safe mode, recovery mode or a pre-installation environment)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
            - enabled
        privilegedProcess:
          type: object
          description: Include only devices on which Prisma Browser is running with elevated/root permissions
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
            - enabled
        deviceManufacturer:
          type: object
          description: Check if the device is from specific manufacturers (e.g., Dell, HP, Lenovo)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            selectedVendors:
              type: array
              items:
                $ref: '#/components/schemas/SelectedDeviceVendor'
              description: List of device manufacturers with optional specific models to check for
          required:
            - enabled
        deviceManagement:
          type: object
          description: Check if the device is managed by specific device management systems (e.g., Microsoft Intune, Jamf, Active Directory)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            systems:
              type: array
              items:
                $ref: '#/components/schemas/DeviceManagementSystemInput'
              description: Device management system configurations
          required:
            - enabled
        systemIntegrity:
          type: object
          description: Check if the device has advanced system integrity protection enabled
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
            - enabled
        browserBrand:
          type: object
          description: Check if the device has specific browser brands and versions installed
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            brands:
              type: array
              items:
                $ref: '#/components/schemas/BrowserBrandDetails'
              description: Browser brand and version requirements
          required:
            - enabled
        remoteConnection:
          type: object
          description: Check if the device has an active remote connection (RDP, Citrix ICA, etc.)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
            - enabled
        registry:
          type: object
          description: Check if the device has all of the specified registry key configurations (Windows only)
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            regKeys:
              type: array
              items:
                $ref: '#/components/schemas/RegKey'
              description: Registry key configurations to validate
          required:
            - enabled
        locationServices:
          type: object
          description: Check if the device's location services can be accessed by Prisma Browser
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
            - enabled
        runningProcesses:
          type: object
          description: Check if the device has all of the specified processes running
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            win:
              type: array
              items:
                $ref: '#/components/schemas/WinRunningProcessMetadata'
              description: Windows process requirements to check for
            macOS:
              type: array
              items:
                $ref: '#/components/schemas/MacOSRunningProcessMetadata'
              description: macOS process requirements to check for
          required:
            - enabled
        fileExistence:
          type: object
          description: Check if the device has all of the specified files present
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
            win:
              type: array
              items:
                $ref: '#/components/schemas/WinFileExistenceMetadata'
              description: Windows file paths to check for existence
            macOS:
              type: array
              items:
                $ref: '#/components/schemas/MacOSFileExistenceMetadata'
              description: macOS file paths to check for existence
          required:
            - enabled
        browserEol:
          type: object
          description: Check if the device has browser versions that are end-of-life
          properties:
            negate:
              type: boolean
              default: false
            enabled:
              type: boolean
          required:
            - enabled
      additionalProperties: false
    AuthenticationFactorControl:
      title: AuthenticationFactorControl
      type: object
      nullable: true
      description: The authentication factor is used to unlock the browser, or for step-up MFA.
      oneOf:
        - $ref: '#/components/schemas/AuthenticationFactorPinCodeControl'
        - $ref: '#/components/schemas/AuthenticationFactorPasskeyControl'
        - $ref: '#/components/schemas/AuthenticationFactorIdentityProviderControl'
      discriminator:
        propertyName: method
        mapping:
          pinCode: '#/components/schemas/AuthenticationFactorPinCodeControl'
          passkey: '#/components/schemas/AuthenticationFactorPasskeyControl'
          identityProvider: '#/components/schemas/AuthenticationFactorIdentityProviderControl'
    AuthenticationFactorIdentityProviderControl:
      title: AuthenticationFactorIdentityProviderControl
      type: object
      description: Identity provider authentication factor settings.
      additionalProperties: false
      required:
        - method
        - identityProvider
      properties:
        method:
          type: string
          description: Method used for browser unlock and step-up MFA.
          enum:
            - identityProvider
        identityProvider:
          type: object
          description: Identity provider settings.
          additionalProperties: false
          properties:
            profileSource:
              type: string
              description: Whether to use the configured authentication profile or specify a custom one.
              enum:
                - useConfiguredAuthProfile
                - custom
              default: useConfiguredAuthProfile
            authProfileId:
              type: string
              description: |
                Authentication profile ID (a CIE GUID) used when profileSource is 'custom'.
                Authentication profiles are managed in Cloud Identity Engine (CIE) and are not yet listed on pan.dev.
                To discover the valid profiles for the tenant, call the CIE API Proxy endpoints:
                - `GET /cie/cas/v1/auth-profiles` - returns the profile list with `profile_id`, `display_name`, `mode`, `mfa_enforceable`, and `auth_types`.
                - `GET /cie/cas/v1/detailed-auth-profiles` - returns the full per-profile IdP configuration.
                Use the `profile_id` value from those responses as the authProfileId here.
                When profileSource is 'useConfiguredAuthProfile', the tenant's globally-configured profile is used and authProfileId is not required.
              minLength: 1
              maxLength: 128
              pattern: \S
            incognito:
              type: boolean
              description: Whether to perform IdP authentication in an isolated browser session.
              default: true
            forceReauthentication:
              type: boolean
              description: Whether to force re-authentication with the IdP rather than using an existing session.
              default: true
    AuthenticationFactorPasskeyControl:
      title: AuthenticationFactorPasskeyControl
      type: object
      description: Passkey authentication factor settings.
      additionalProperties: false
      required:
        - method
        - passkey
      properties:
        method:
          type: string
          description: Method used for browser unlock and step-up MFA.
          enum:
            - passkey
        passkey:
          type: object
          description: Passkey authenticator settings.
          additionalProperties: false
          required:
            - internalAuthenticator
            - externalAuthenticator
          properties:
            internalAuthenticator:
              type: boolean
              description: Allow passkeys from device-bound authenticators such as Windows Hello or macOS Keychain.
            externalAuthenticator:
              type: boolean
              description: Allow passkeys from external authenticators such as Yubikey, smartcard, or mobile phone.
    AuthenticationFactorPinCodeControl:
      title: AuthenticationFactorPinCodeControl
      type: object
      description: PIN code authentication factor settings.
      additionalProperties: false
      required:
        - method
        - pinCode
      properties:
        method:
          type: string
          description: Method used for browser unlock and step-up MFA.
          enum:
            - pinCode
        pinCode:
          type: object
          description: PIN code settings.
          additionalProperties: false
          properties:
            minLength:
              type: integer
              description: Required PIN length.
              minimum: 4
              maximum: 8
              default: 6
            maxFailedAttempts:
              type: integer
              description: Maximum failed PIN attempts before the user is locked out. Use 0 for unlimited.
              enum:
                - 0
                - 1
                - 2
                - 5
                - 15
                - 20
                - 30
              default: 5
    AuthenticationServerAllowlistControl:
      title: AuthenticationServerAllowlistControl
      type: object
      nullable: true
      description: List the servers allowed to use Integrated Authentication.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to set an authentication server allowlist or unset it.
          enum:
            - allowList
            - unset
        includedDomains:
          type: array
          description: Servers allowed to use Integrated Authentication.
          maxItems: 1000
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Domain'
    AuthenticationState:
      type: string
      description: |
        Authentication state for the rule. `unauthenticated` marks a pre-login rule that applies to anonymous Prisma Browser Extension users before they authenticate. When omitted on write the rule is `authenticated` (a standard rule); on read this field is present only for pre-login rules. It is mutable: a PATCH may switch a rule between `authenticated` and `unauthenticated`, and the merged rule is re-validated against the constraints below.

        When `unauthenticated`, the rule must satisfy all of the following (otherwise the write returns 400):

        - `scope` must be empty - a pre-login rule applies to all users, with no user, device-group, IP, or location conditions.
        - `mode` must be `active` or `disabled` (`monitor` is not allowed).
        - `applications` may only use `saas` and `applicationGroups`, and at least one must target something (`saas.accessMode` other than `none`, or a specific `applicationGroups`). `private`, `localDesktop`, and `nonWeb` must be `none`; `webClassifications` and `tenantConditions` are not allowed.
        - `access.action` must be `allow` or `block` (`prompt` and `redirect` are not allowed), and no access controls (e.g. `userPrompt`, `customDialogText`, `mfaRequired`) may be set.
        - `loginControls` and `dataControls` are not allowed.
        - `tracking` may only set `logLevel` to `off` and `sessionRecording` to `false`; no other tracking fields may be set.
      enum:
        - authenticated
        - unauthenticated
    AutoLaunchExternalApplicationsControl:
      title: AutoLaunchExternalApplicationsControl
      type: object
      nullable: true
      description: Control whether websites can open external desktop apps without prompting users.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether matching websites can bypass the external application launch prompt
          enum:
            - bypassPrompt
            - alwaysPromptUser
        rules:
          type: array
          description: Rules for auto-launching external applications
          minItems: 1
          maxItems: 100
          items:
            type: object
            additionalProperties: false
            required:
              - protocol
              - allowedOrigins
            properties:
              protocol:
                type: string
                description: External application protocol scheme
                minLength: 1
                maxLength: 256
                pattern: ^(?!.*//)[^:\s]+$
              allowedOrigins:
                type: array
                uniqueItems: true
                description: Origins allowed to launch the protocol without prompting
                minItems: 1
                maxItems: 100
                items:
                  type: string
                  description: Origin in the form `[scheme://]host[/]`. Cannot contain a path, userinfo, query, or whitespace.
                  minLength: 1
                  maxLength: 2048
                  pattern: ^([^@?:/\s]+://)?[^@?/\s]+/?$
    AutomaticClientCertificateSelectionControl:
      title: AutomaticClientCertificateSelectionControl
      type: object
      nullable: true
      description: Automatically selects matching client certificates for specified URLs to facilitate seamless authentication.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether automatic client certificate selection is enabled
          enum:
            - enable
            - disable
        rules:
          type: array
          description: URL sets and certificate filters for automatic client certificate selection
          minItems: 1
          items:
            type: object
            additionalProperties: false
            required:
              - urlPatterns
              - filter
            properties:
              urlPatterns:
                type: array
                uniqueItems: true
                description: URL patterns where matching client certificates are selected automatically
                minItems: 1
                items:
                  type: string
                  minLength: 1
                  pattern: \S
              filter:
                type: object
                description: Certificate matching criteria for the URL set
                additionalProperties: false
                properties:
                  issuer:
                    type: object
                    description: Optional issuer certificate criteria
                    additionalProperties: false
                    properties:
                      commonName:
                        type: string
                        description: Issuer common name (CN)
                        minLength: 1
                        pattern: \S
                      location:
                        type: string
                        description: Issuer location (L)
                        minLength: 1
                        pattern: \S
                      organization:
                        type: string
                        description: Issuer organization (O)
                        minLength: 1
                        pattern: \S
                      organizationalUnit:
                        type: string
                        description: Issuer organizational unit (OU)
                        minLength: 1
                        pattern: \S
                  subject:
                    type: object
                    description: Optional subject certificate criteria
                    additionalProperties: false
                    properties:
                      commonName:
                        type: string
                        description: Subject common name (CN)
                        minLength: 1
                        pattern: \S
                      location:
                        type: string
                        description: Subject location (L)
                        minLength: 1
                        pattern: \S
                      organization:
                        type: string
                        description: Subject organization (O)
                        minLength: 1
                        pattern: \S
                      organizationalUnit:
                        type: string
                        description: Subject organizational unit (OU)
                        minLength: 1
                        pattern: \S
    AwsTenantCondition:
      title: AwsTenantCondition
      type: object
      properties:
        accountIds:
          type: array
          uniqueItems: true
          items:
            type: string
            pattern: ^\d{12}$
            description: 12-digit AWS account ID
          minItems: 1
          maxItems: 35000
          description: List of allowed AWS account IDs
        regions:
          type: array
          uniqueItems: true
          items:
            type: string
            enum:
              - us-east-1
              - us-east-2
              - us-west-1
              - us-west-2
              - af-south-1
              - ap-east-1
              - ap-south-1
              - ap-south-2
              - ap-northeast-1
              - ap-northeast-2
              - ap-northeast-3
              - ap-southeast-1
              - ap-southeast-2
              - ap-southeast-3
              - ap-southeast-4
              - ca-central-1
              - eu-central-1
              - eu-central-2
              - eu-west-1
              - eu-west-2
              - eu-west-3
              - eu-south-1
              - eu-south-2
              - eu-north-1
              - il-central-1
              - me-south-1
              - me-central-1
              - sa-east-1
              - us-gov-east-1
              - us-gov-west-1
          minItems: 1
          maxItems: 100
          description: List of allowed AWS regions
      minProperties: 1
      additionalProperties: false
    BackgroundImageControl:
      title: BackgroundImageControl
      type: object
      nullable: true
      description: Set new tab page background
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: New tab page background configuration
          enum:
            - defaultBackground
            - setImage
            - setFillColor
        backgroundImageId:
          type: string
          minLength: 1
          maxLength: 100
          description: Background image asset identifier. Set `backgroundImageId` to the value returned by POST /assets/background-image.
        backgroundColor:
          type: string
          pattern: ^#[0-9a-fA-F]{6}$
          description: Custom fill color for the new tab background
        pageMode:
          type: string
          description: New tab page display mode
          enum:
            - default
            - light
            - dark
        backgroundImageFilterMode:
          type: string
          description: Whether to use the default image filter or set a custom filter overlay
          enum:
            - default
            - custom
        backgroundImageFilterColor:
          type: string
          pattern: ^#[0-9a-fA-F]{6}$
          description: Custom overlay color applied on top of the background image
        backgroundImageFilterOpacity:
          type: string
          description: Opacity of the custom overlay applied on top of the background image
          enum:
            - '0'
            - '0.05'
            - '0.10'
            - '0.15'
            - '0.20'
            - '0.25'
            - '0.30'
            - '0.35'
            - '0.40'
            - '0.45'
            - '0.50'
            - '0.55'
            - '0.60'
            - '0.65'
            - '0.70'
            - '0.75'
            - '0.80'
            - '0.85'
            - '0.90'
            - '0.95'
        invertLogoColor:
          type: boolean
          description: Whether to invert the logo color so it stands out on the homepage
    BackgroundImageUploadResponse:
      title: BackgroundImageUploadResponse
      type: object
      required:
        - backgroundImageId
      properties:
        backgroundImageId:
          type: string
          description: Background image asset identifier. Pass this value as-is to the `backgroundImage` control's `backgroundImageId` field.
    BadRequestResponse:
      title: BadRequestResponse
      description: Error envelope returned for 400 Bad Request responses.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/ValidationError'
    BaseApiError:
      title: BaseApiError
      description: Inner error body shared by every typed error variant. Carries a machine-readable code, a human-readable message, and a timestamp. The code vocabulary is open (new codes may be introduced over time). Variants that need structured context add their own typed `details` object on top of this base.
      type: object
      required:
        - code
        - message
        - timestamp
      properties:
        code:
          type: string
          description: Machine-readable error code (open vocabulary).
        message:
          type: string
          description: Human-readable error message.
        timestamp:
          type: string
          format: date-time
          readOnly: true
          description: When the error occurred.
    BaseApplication:
      title: BaseApplication
      type: object
      properties:
        id:
          type: string
          description: Unique identifier
        name:
          type: string
          description: Name of the application
        description:
          type: string
          description: Description of the application
        type:
          type: string
          enum:
            - custom
            - private
            - non-web
            - catalog
            - localdesktopcustom
            - localdesktopcatalog
        category:
          type: string
        classification:
          $ref: '#/components/schemas/Classification'
        tags:
          type: array
          description: Custom (non-classification) application tags.
          items:
            $ref: '#/components/schemas/Tag'
        metadata:
          $ref: '#/components/schemas/metadata'
      required:
        - id
        - name
        - type
        - metadata
    BaseApplicationInput:
      title: BaseApplicationInput
      type: object
      properties:
        name:
          type: string
          description: Name of the application
        description:
          type: string
          description: Description of the application
          maxLength: 2500
        type:
          $ref: '#/components/schemas/ApplicationTypeInput'
        classification:
          $ref: '#/components/schemas/Classification'
        tagIDs:
          $ref: '#/components/schemas/TagIDsInput'
      required:
        - name
        - type
    BaseApplicationWithUrls:
      title: BaseApplicationWithUrls
      description: Base Application with URLs (for URL-based application types)
      allOf:
        - $ref: '#/components/schemas/BaseApplication'
        - type: object
          properties:
            urls:
              type: array
              uniqueItems: true
              description: URL patterns for the application
              items:
                type: string
          required:
            - urls
    BaseLocalDesktopApplication:
      title: BaseLocalDesktopApplication
      description: Base Local Desktop Application (shared by custom and catalog local desktop apps)
      allOf:
        - $ref: '#/components/schemas/BaseApplication'
        - type: object
          properties:
            executables:
              $ref: '#/components/schemas/LocalDesktopAppExecutables'
          required:
            - executables
    BasePatchApplicationInput:
      title: BasePatchApplicationInput
      type: object
      properties:
        name:
          type: string
          description: Name of the application
        description:
          type: string
          description: Description of the application
          maxLength: 2500
        type:
          $ref: '#/components/schemas/ApplicationTypeInput'
        classification:
          $ref: '#/components/schemas/Classification'
        tagIDs:
          $ref: '#/components/schemas/PatchTagIDs'
      required:
        - type
    BasePatchRuleRequest:
      title: BasePatchRuleRequest
      type: object
      minProperties: 1
      properties:
        name:
          type: string
          description: The name or title of the rule.
          minLength: 1
          maxLength: 300
          pattern: \S
        description:
          type: string
          description: The detailed description of the rule.
          maxLength: 300
        scope:
          $ref: '#/components/schemas/PatchScope'
        positioning:
          $ref: '#/components/schemas/PolicyPositioning'
    BasePolicyItem:
      title: BasePolicyItem
      type: object
      required:
        - id
        - position
      properties:
        id:
          type: string
          description: The unique identifier for the policy item.
        position:
          type: integer
          format: int32
          description: 1-based index of this item in the flat list.
        name:
          type: string
          description: The name or title of the rule or section.
    BasePostRuleRequest:
      title: BasePostRuleRequest
      type: object
      minProperties: 1
      required:
        - name
        - mode
      properties:
        name:
          type: string
          description: The name or title of the rule.
          minLength: 1
          maxLength: 300
          pattern: \S
        description:
          type: string
          description: The detailed description of the rule.
          maxLength: 300
        scope:
          $ref: '#/components/schemas/PostScope'
        positioning:
          $ref: '#/components/schemas/PolicyPositioning'
    BeforeFileAction:
      title: BeforeFileAction
      type: object
      description: Prompt and MFA settings applied before the action is enforced.
      additionalProperties: false
      minProperties: 1
      properties:
        userPrompt:
          description: Whether and how the user is prompted before the action is enforced.
          $ref: '#/components/schemas/UserPrompt'
        mfaRequired:
          description: Whether the user must complete an MFA challenge before the action.
          $ref: '#/components/schemas/MfaRequired'
    BlockExtensionsByPermissionsControl:
      title: BlockExtensionsByPermissionsControl
      type: object
      nullable: true
      description: Prevent users from running extensions that require certain permissions.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to grant all permissions or block extensions that use specific permissions.
          enum:
            - grantAll
            - blockByPermission
        blockedPermissions:
          type: array
          description: Chrome extension permissions to block.
          maxItems: 71
          uniqueItems: true
          items:
            type: string
            enum:
              - activeTab
              - alarms
              - audioCapture
              - background
              - bookmarks
              - browsingData
              - captivePortalAuthenticator
              - certificateProvider
              - clipboardRead
              - clipboardWrite
              - contentSettings
              - contextMenus
              - cookies
              - cpuMetadata
              - debugger
              - declarativeContent
              - declarativeNetRequest
              - desktopCapture
              - detectIdle
              - displayMetadata
              - documentScan
              - downloads
              - downloadsShelf
              - enterpriseDeviceAttributes
              - experimentalAPIs
              - fileBrowserHandler
              - fileSystem
              - fileSystemProvider
              - fontSettings
              - fullscreenApps
              - fullscreenOverrideEsc
              - gcm
              - geolocation
              - hid
              - history
              - identity
              - identityEmail
              - loginState
              - management
              - mediaGalleries
              - memoryMetadata
              - nativeMessaging
              - networkMetadata
              - notifications
              - pageCapture
              - platformKeys
              - power
              - printerProvider
              - privacy
              - processes
              - proxy
              - scripting
              - search
              - serial
              - sessions
              - signedInDevices
              - storage
              - syncFileSystem
              - systemStorage
              - tabCapture
              - tabs
              - topSites
              - ttsEngine
              - unlimitedStorage
              - usb
              - videoCapture
              - vpnProvider
              - wallpaper
              - webNavigation
              - webRequests
              - devtools
    BrandColorControl:
      title: BrandColorControl
      type: object
      nullable: true
      description: Choose a brand color to be applied across all user-facing browser elements, including dialogs, block pages, and other elements
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether to use the default brand color or a custom one
          enum:
            - default
            - custom
        color:
          type: string
          description: Brand color applied to user-facing browser elements
          pattern: ^#[0-9a-fA-F]{6}$
    BrowserBrand:
      title: BrowserBrand
      type: string
      description: Browser brand
      enum:
        - Arc
        - Brave
        - Chrome
        - Edge
        - Opera
        - Dia
        - Comet
        - Unknown
    BrowserBrandDetails:
      title: BrowserBrandDetails
      type: object
      properties:
        brand:
          $ref: '#/components/schemas/BrowserBrand'
        minVersion:
          type: string
      required:
        - brand
    BrowserHistoryControl:
      title: BrowserHistoryControl
      type: object
      nullable: true
      description: Control the ability to delete history from the browser.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Browser History action.
          enum:
            - enable
            - disable
            - preventDeletion
    BrowserIconControl:
      title: BrowserIconControl
      type: object
      nullable: true
      description: Set the icon for the browser in the operating system
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether a custom browser icon is configured
          enum:
            - setBrowserIcon
            - usePrismaBrowserIcon
        browserIconId:
          type: string
          minLength: 1
          maxLength: 100
          description: Browser icon asset identifier. Set `browserIconId` to the value returned by POST /assets/browser-icon.
    BrowserIconUploadResponse:
      title: BrowserIconUploadResponse
      type: object
      required:
        - browserIconId
      properties:
        browserIconId:
          type: string
          description: Browser icon asset identifier. Pass this value as-is to the `browserIcon` control's `browserIconId` field.
    BrowserLockControl:
      title: BrowserLockControl
      type: object
      nullable: true
      description: Require the user to unlock their browser.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Browser Lock is enabled.
          enum:
            - enable
            - disable
        idleTimeoutMinutes:
          type: integer
          format: int32
          description: Time the user can be idle before the browser locks. Use 0 for never. Applies when action is 'enable'. Defaults to 0.
          enum:
            - 0
            - 1
            - 2
            - 5
            - 15
            - 20
            - 30
            - 60
            - 180
            - 360
            - 720
    BrowserSelfProtectionControl:
      title: BrowserSelfProtectionControl
      type: object
      nullable: true
      description: Enables a kernel-mode driver that provides advanced runtime security for the browser. This protection is available only on Windows and applies only to devices where Prisma Browser is installed with admin permissions and the user is running the browser as admin.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Browser Self-Protection is enabled.
          enum:
            - enable
            - disable
        enforcement:
          type: string
          description: Enforcement for Inactive Protection. Applies when action is 'enable'.
          enum:
            - none
            - prompt
            - block
    BrowserSelfProtectionModule:
      title: BrowserSelfProtectionModule
      type: object
      description: Browser self-protection module
      properties:
        windows:
          type: object
          description: Windows driver info
          properties:
            status:
              $ref: '#/components/schemas/BrowserSelfProtectionWindowsDriverStatus'
    BrowserSelfProtectionWindowsDriverStatus:
      title: BrowserSelfProtectionWindowsDriverStatus
      type: string
      description: Windows driver status
      default: Unknown
      enum:
        - Unknown
        - Protected
        - Inactive
        - UnprotectedArmIncompatible
        - UnprotectedUserInstall
        - Unprotected
    BulkCreatedItem:
      title: BulkCreatedItem
      type: object
      properties:
        id:
          type: string
          description: The ID of the newly created resource
        name:
          type: string
          description: The name of the newly created resource
      required:
        - id
        - name
    BulkCreatedResponse:
      title: BulkCreatedResponse
      type: array
      items:
        $ref: '#/components/schemas/BulkCreatedItem'
    CannotDeleteSuspendedDeviceError:
      description: Suspended devices cannot be deleted; resume them first.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - CANNOT_DELETE_SUSPENDED_DEVICE
              description: Discriminator - always "CANNOT_DELETE_SUSPENDED_DEVICE".
    CatalogApplication:
      title: CatalogApplication
      description: Catalog Application
      type: object
      allOf:
        - $ref: '#/components/schemas/BaseApplicationWithUrls'
        - type: object
          properties:
            type:
              type: string
              description: Discriminator field, must be 'catalog'.
              enum:
                - catalog
            catalog_name:
              type: string
              description: The name in the application catalog
            catalog_attributes:
              $ref: '#/components/schemas/CatalogAttributes'
    CatalogAttributes:
      title: CatalogAttributes
      description: Catalog application attributes sourced from the Universal Application Directory (UAD)
      type: object
      properties:
        spoof_risk_level:
          type: string
          nullable: true
        disaster_recovery:
          type: boolean
          nullable: true
        encryption_in_transit:
          type: boolean
          nullable: true
        native_data_classification:
          type: boolean
          nullable: true
        audit_log:
          type: boolean
          nullable: true
        data_retention:
          type: string
          nullable: true
        file_content_sharing:
          type: boolean
          nullable: true
        session_timeout:
          type: string
          nullable: true
        encryption_at_rest:
          type: boolean
          nullable: true
        encryption_strength_at_rest:
          type: string
          nullable: true
        protected_from_downgrade_attacks:
          type: boolean
          nullable: true
        privacy_policy:
          type: boolean
          nullable: true
        data_ownership:
          type: string
          nullable: true
        third_party_data_sharing:
          type: boolean
          nullable: true
        http_security_headers:
          type: string
          nullable: true
        terms_and_conditions:
          type: boolean
          nullable: true
        iso_9000:
          type: boolean
          nullable: true
        iso_9001:
          type: boolean
          nullable: true
        iso_27001:
          type: boolean
          nullable: true
        iso_27002:
          type: boolean
          nullable: true
        iso_27017:
          type: boolean
          nullable: true
        iso_27018:
          type: boolean
          nullable: true
        soc1:
          type: boolean
          nullable: true
        soc2:
          type: boolean
          nullable: true
        pci:
          type: boolean
          nullable: true
        hipaa:
          type: boolean
          nullable: true
        gdpr:
          type: boolean
          nullable: true
        ferpa:
          type: boolean
          nullable: true
        coppa:
          type: boolean
          nullable: true
        finra:
          type: boolean
          nullable: true
        ffiec:
          type: boolean
          nullable: true
        glba:
          type: boolean
          nullable: true
        gapp:
          type: boolean
          nullable: true
        itar:
          type: boolean
          nullable: true
        hitrust_csf:
          type: boolean
          nullable: true
        trustarc:
          type: boolean
          nullable: true
        fedramp:
          type: boolean
          nullable: true
        c5:
          type: boolean
          nullable: true
        ssae18:
          type: boolean
          nullable: true
        nist_sp_80053:
          type: boolean
          nullable: true
        fisma:
          type: boolean
          nullable: true
        privacy_mark_japan:
          type: boolean
          nullable: true
        privacy_shield:
          type: boolean
          nullable: true
        safe_harbor:
          type: boolean
          nullable: true
        cobit:
          type: boolean
          nullable: true
        csa_star:
          type: boolean
          nullable: true
        jericho_forum_comm:
          type: boolean
          nullable: true
        sox:
          type: boolean
          nullable: true
        cjis:
          type: boolean
          nullable: true
        isae_3402:
          type: boolean
          nullable: true
        input_data_types:
          type: array
          uniqueItems: true
          nullable: true
          items:
            type: string
        output_data_types:
          type: array
          uniqueItems: true
          nullable: true
          items:
            type: string
        consumption_modes:
          type: array
          uniqueItems: true
          nullable: true
          items:
            type: string
        genai_types:
          type: array
          uniqueItems: true
          nullable: true
          items:
            type: string
        data_used_in_models:
          type: string
          nullable: true
        allows_fine_tuning:
          type: boolean
          nullable: true
        has_marketplace:
          type: boolean
          nullable: true
        input_monitoring_and_review:
          type: string
          nullable: true
        security_guardrails:
          type: array
          uniqueItems: true
          nullable: true
          items:
            type: string
        copyright_indemnity:
          type: string
          nullable: true
        rbac:
          type: boolean
          nullable: true
        mfa:
          type: boolean
          nullable: true
        password_policy:
          type: boolean
          nullable: true
        ip_based_restrictions:
          type: boolean
          nullable: true
        saml:
          type: boolean
          nullable: true
        quantum_readiness:
          type: boolean
          nullable: true
        pqc_method:
          type: array
          uniqueItems: true
          nullable: true
          items:
            type: string
    CertificateDN:
      title: CertificateDN
      type: object
      properties:
        CN:
          type: string
        O:
          type: string
        OU:
          type: string
        L:
          type: string
    CidrsInput:
      title: CidrsInput
      type: array
      description: CIDR ranges for the private application. IPv4 only, /8 to /32. Maximum 100 CIDRs.
      items:
        type: string
      maxItems: 100
    Classification:
      title: Classification
      type: string
      description: Application classification derived from its classification tag.
      enum:
        - Sanctioned
        - Tolerated
        - Unsanctioned
        - Unclassified
    ClaudeAITenantCondition:
      title: ClaudeAITenantCondition
      type: object
      properties:
        accountIds:
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 100
          minItems: 1
          maxItems: 100
          description: List of allowed Claude AI account IDs
        domains:
          type: array
          uniqueItems: true
          items:
            type: string
            pattern: ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$
            maxLength: 2048
            description: Valid domain name (e.g., example.com, sub.example.com)
          minItems: 1
          maxItems: 100
          description: List of allowed Claude AI domains
      minProperties: 1
      additionalProperties: false
    ClipboardControl:
      title: ClipboardControl
      type: object
      nullable: true
      description: 'Control cut, copy and paste. At least one direction must be active: either dataIn.active or dataOut.active must be true.'
      additionalProperties: false
      properties:
        dataIn:
          $ref: '#/components/schemas/ClipboardControlOptions'
        dataOut:
          $ref: '#/components/schemas/ClipboardControlOptions'
    ClipboardControlOptions:
      title: ClipboardControlOptions
      type: object
      description: Clipboard direction settings.
      additionalProperties: false
      required:
        - active
      properties:
        active:
          type: boolean
          description: Whether this clipboard direction is configured.
        action:
          type: string
          description: Action applied to this clipboard direction.
          enum:
            - allow
            - block
        excludeOmnibox:
          type: boolean
          description: Whether to exclude the browser URL address bar from the restriction.
        userPrompt:
          description: How the user is prompted when the clipboard restriction triggers. Only valid when action is 'block' (dataOut) or 'allow' (dataIn).
          $ref: '#/components/schemas/UserPrompt'
        customDialogText:
          $ref: '#/components/schemas/CustomDialogText'
    CloudStorageConflictResponse:
      title: CloudStorageConflictResponse
      description: Error envelope returned when a cloud storage provider cannot be deleted.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/ProviderInUseError'
    CloudStorageProvider:
      title: CloudStorageProvider
      type: object
      description: A cloud storage provider integration.
      required:
        - id
        - displayName
        - type
        - status
      properties:
        id:
          type: string
          description: Unique identifier for the provider.
        displayName:
          type: string
          description: Human-readable name for the provider.
        type:
          $ref: '#/components/schemas/CloudStorageProviderType'
        status:
          $ref: '#/components/schemas/CloudStorageProviderStatus'
        microsoft:
          $ref: '#/components/schemas/MicrosoftProperties'
        google:
          $ref: '#/components/schemas/GoogleProperties'
    CloudStorageProviderStatus:
      title: CloudStorageProviderStatus
      type: string
      description: Live connectivity status of the cloud storage provider.
      enum:
        - connected
        - disconnected
    CloudStorageProviderType:
      title: CloudStorageProviderType
      type: string
      description: The cloud storage provider type.
      enum:
        - microsoft
        - google
    CompanyLogoControl:
      title: CompanyLogoControl
      type: object
      nullable: true
      description: Set the logo displayed in the browser on dialogs, homepage, and other pages.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether a company logo is configured
          enum:
            - setCompanyLogo
            - noCompanyLogo
        companyLogoId:
          type: string
          minLength: 1
          maxLength: 100
          description: Company logo asset identifier. Set `companyLogoId` to the value returned by POST /assets/company-logo.
    CompanyLogoUploadResponse:
      title: CompanyLogoUploadResponse
      type: object
      required:
        - companyLogoId
      properties:
        companyLogoId:
          type: string
          description: Company logo asset identifier. Pass this value as-is to the `companyLogo` control's `companyLogoId` field.
    CompanyNameControl:
      title: CompanyNameControl
      type: object
      nullable: true
      description: Set the name displayed in the browser on dialogs, homepage, and other pages.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether to display a company name or no name
          enum:
            - setName
            - noName
        name:
          type: string
          description: Company name displayed in browser surfaces. Rejects CR, LF, and other control characters while allowing spaces and unicode.
          minLength: 1
          maxLength: 100
          pattern: ^(?=.*\S)[^\x00-\x1f\x7f]+$
    ConcurrentNumberOfDevicesControl:
      title: ConcurrentNumberOfDevicesControl
      type: object
      nullable: true
      description: Control the maximum number of devices users can be logged into at the same time. Which fields are required or allowed depends on action and limitMode (see individual field descriptions).
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to limit the number of concurrent devices. When 'unlimited', no other fields may be set.
          enum:
            - limited
            - unlimited
        limitMode:
          type: string
          description: Whether the device limit applies to all devices combined or per device type. Required when action is 'limited'. Must not be set when action is 'unlimited'.
          enum:
            - byTotalDevices
            - byDeviceType
        maxTotalDevices:
          type: integer
          description: Maximum total number of devices a user can be logged into across all device types. Required when limitMode is 'byTotalDevices'. Must not be set when limitMode is 'byDeviceType' or when action is 'unlimited'.
          minimum: 1
          maximum: 5
        maxDesktopDevices:
          type: integer
          nullable: true
          description: Maximum number of desktop devices (macOS/Windows/Linux). Use null for no limit, or 0 to block desktop devices entirely. Required when limitMode is 'byDeviceType'. Must not be set when limitMode is 'byTotalDevices' or when action is 'unlimited'. maxDesktopDevices and maxMobileDevices cannot both be null, and cannot both be 0.
          minimum: 0
          maximum: 5
        maxMobileDevices:
          type: integer
          nullable: true
          description: Maximum number of mobile devices (iOS/Android). Use null for no limit, or 0 to block mobile devices entirely. Required when limitMode is 'byDeviceType'. Must not be set when limitMode is 'byTotalDevices' or when action is 'unlimited'. maxDesktopDevices and maxMobileDevices cannot both be null, and cannot both be 0.
          minimum: 0
          maximum: 5
    ConflictError:
      description: The request conflicts with the current state of the resource.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - CONFLICT
              description: Discriminator - always "CONFLICT".
    ConflictResponse:
      description: Error envelope returned for 409 Conflict responses.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/ConflictError'
    ContiguityViolationError:
      title: ContiguityViolationError
      description: The rules of a section are not contiguous in the submitted order.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          required:
            - details
          properties:
            code:
              type: string
              enum:
                - CONTIGUITY_VIOLATION
              description: Discriminator - always "CONTIGUITY_VIOLATION".
            details:
              $ref: '#/components/schemas/ContiguityViolationErrorDetails'
    ContiguityViolationErrorDetails:
      title: ContiguityViolationErrorDetails
      description: Structured context for a section contiguity violation. Identifies the section whose rules are not contiguous and lists the rule IDs involved.
      type: object
      required:
        - sectionId
        - error
        - ruleIds
      additionalProperties: false
      properties:
        sectionId:
          type: string
          description: ID of the section whose rules are not contiguous.
        error:
          type: string
          description: Human-readable explanation of the contiguity problem.
        ruleIds:
          type: array
          description: IDs of the rules that belong to the section.
          items:
            type: string
    ControlSetRef:
      title: ControlSetRef
      type: object
      description: |
        Reference to the shared control set (policy profile) this rule's controls are inherited from. Returned only when the rule links a shared control set; rules that configure controls inline do not include this field.
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: Control set (policy profile) identifier.
        name:
          type: string
          description: Control set (policy profile) display name.
    CookiesControl:
      title: CookiesControl
      type: object
      nullable: true
      description: Control the ability to store cookies on the browser.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Cookies action.
          enum:
            - allow
            - block
            - clearOnSessionEnd
        excludedDomains:
          type: array
          description: Domains excluded from the chosen action. Only supported when action is allow or block.
          maxItems: 1000
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Domain'
        includedDomains:
          type: array
          description: Domains to include for session-only cookie storage. Only supported when action is clearOnSessionEnd.
          maxItems: 1000
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Domain'
    CountryCodeArray:
      title: CountryCodeArray
      type: array
      uniqueItems: true
      nullable: true
      maxItems: 1000
      items:
        $ref: '#/components/schemas/Locations'
    CreateGoogleProviderRequest:
      title: CreateGoogleProviderRequest
      type: object
      description: Request body to create a Google Drive provider.
      required:
        - emailAddress
        - serviceAccountKey
      properties:
        emailAddress:
          type: string
          description: Google Workspace admin email for domain-wide delegation.
          minLength: 1
        serviceAccountKey:
          type: string
          description: Base64-encoded Google service account JSON key.
          minLength: 1
    CreateMicrosoftProviderRequest:
      title: CreateMicrosoftProviderRequest
      type: object
      description: Request body to create a Microsoft OneDrive provider.
      required:
        - tenantId
        - clientId
        - clientSecret
      properties:
        tenantId:
          type: string
          description: Azure AD tenant ID.
          minLength: 1
        clientId:
          type: string
          description: Azure AD application (client) ID.
          minLength: 1
        clientSecret:
          type: string
          description: Azure AD application client secret.
          minLength: 1
    CreateOrReplaceAppGroupInput:
      title: CreateOrReplaceAppGroupInput
      type: object
      properties:
        name:
          type: string
          description: Name of the application group
        description:
          type: string
          description: Description of the application group
        applications:
          type: array
          items:
            type: string
            pattern: ^0AP[0-9A-HJKMNP-TV-Z]{26}$
          minItems: 0
          maxItems: 2000
          description: List of member application IDs
      required:
        - name
    CreateOrReplaceAppInput:
      title: CreateOrReplaceAppInput
      oneOf:
        - $ref: '#/components/schemas/CustomApplicationInput'
        - $ref: '#/components/schemas/PrivateApplicationInput'
        - $ref: '#/components/schemas/NonWebApplicationInput'
        - $ref: '#/components/schemas/LocalDesktopApplicationInput'
      discriminator:
        propertyName: type
        mapping:
          custom: '#/components/schemas/CustomApplicationInput'
          private: '#/components/schemas/PrivateApplicationInput'
          non-web: '#/components/schemas/NonWebApplicationInput'
          localdesktopcustom: '#/components/schemas/LocalDesktopApplicationInput'
    CreatedIdResponse:
      title: CreatedIdResponse
      type: object
      properties:
        id:
          type: string
          description: The unique identifier of the created resource (PULID, 29 chars).
          example: 0RL0123456789012345678901234
      required:
        - id
    CrowdstrikeZTAPosture:
      title: CrowdstrikeZTAPosture
      type: object
      required:
        - score
        - sensorScore
        - osScore
        - CID
      properties:
        score:
          type: integer
        sensorScore:
          type: integer
        osScore:
          type: integer
        CID:
          type: string
    CsZtaBasicScoreLevel:
      title: CsZtaBasicScoreLevel
      type: string
      enum:
        - Any
        - Low
        - Medium
        - Strict
        - VeryStrict
      description: Predefined basic ZTA score levels
    CsZtaScore:
      title: CsZtaScore
      type: object
      properties:
        min:
          type: integer
        max:
          type: integer
      required:
        - min
        - max
    CustomApplication:
      title: CustomApplication
      description: Custom Application
      type: object
      allOf:
        - $ref: '#/components/schemas/BaseApplicationWithUrls'
        - type: object
          properties:
            type:
              type: string
              description: Discriminator field, must be 'custom'.
              enum:
                - custom
    CustomApplicationInput:
      title: CustomApplicationInput
      allOf:
        - $ref: '#/components/schemas/BaseApplicationInput'
        - type: object
          properties:
            urls:
              $ref: '#/components/schemas/UrlsInput'
            type:
              $ref: '#/components/schemas/CustomTypeInput'
            category:
              type: string
          required:
            - urls
    CustomBrowserPreferencesControl:
      title: CustomBrowserPreferencesControl
      type: object
      nullable: true
      description: Apply custom browser preferences. Please contact Prisma Browser's support team for further guidance. When `mode` is `enabled`, `preferences` is required; when `mode` is `disabled`, `preferences` must not be set.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether custom browser preferences are applied
          enum:
            - enabled
            - disabled
        preferences:
          type: string
          description: Custom browser preferences as a JSON object (e.g. '{"spellcheck.dictionaries":["en-US"]}'). Must be a JSON object; scalars, booleans, null, and arrays are rejected. Required when `mode` is `enabled`; must not be set when `mode` is `disabled`.
          minLength: 1
          pattern: \S
    CustomDialogText:
      title: CustomDialogText
      description: Custom dialog text shown to the user.
      type: object
      required:
        - title
      additionalProperties: false
      properties:
        title:
          type: string
          description: Dialog title.
          minLength: 1
          maxLength: 80
          pattern: \S
        description:
          type: string
          description: Main body text.
          maxLength: 360
        externalLink:
          type: object
          required:
            - label
            - url
          additionalProperties: false
          properties:
            label:
              type: string
              minLength: 1
              maxLength: 80
              pattern: \S
            url:
              $ref: '#/components/schemas/HttpUrl'
    CustomHttpHeaderControl:
      title: CustomHttpHeaderControl
      type: object
      nullable: true
      description: Set a custom HTTP header to identify HTTP/S requests. This control is moving to Access & Data Controls, which replaces the Browser Customization location. During rollout it remains under Browser Customization; once available under Access & Data Controls, new rules are created there and take precedence over any existing Browser Customization rule.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether to keep default headers or add a custom header.
          enum:
            - default
            - custom
        customHeaderName:
          $ref: '#/components/schemas/HttpHeaderName'
        customHeaderValue:
          $ref: '#/components/schemas/HttpHeaderValue'
    CustomLabel:
      title: CustomLabel
      description: Custom address-bar label configuration. Required when addressBarLabel is 'custom'.
      type: object
      required:
        - color
        - icon
      additionalProperties: false
      properties:
        name:
          type: string
          description: Display name for the custom label.
          maxLength: 15
        color:
          type: string
          description: Hex color for the label badge.
          enum:
            - '#F01370'
            - '#0094FF'
            - '#BF79FF'
            - '#FC7910'
            - '#838383'
            - '#00A352'
            - '#F04C4C'
            - '#00AED5'
            - '#42A391'
            - '#C18D08'
        icon:
          type: string
          description: Icon identifier for the custom label.
          enum:
            - Bank
            - Business
            - Camera
            - Check
            - Clock
            - Cloud
            - Code
            - Coffee
            - Dollar
            - Earth
            - Fingerprint
            - Flag
            - Hide
            - Home
            - Office
            - Personal
            - Plane
            - Play
            - Policy
            - Question
            - Risky
            - SafeBox
            - Sensitive
            - Show
            - Social
            - Truck
            - VideoOff
            - VideoOn
            - Wallet
            - Wifi
    CustomNoticeControl:
      title: CustomNoticeControl
      type: object
      nullable: true
      description: Set a customized notice that will be displayed to end-users when they use the Prisma mobile browser.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether the custom notice is shown.
          enum:
            - showNotice
            - doNotShowNotice
        frequency:
          type: string
          description: How often the notice is shown.
          enum:
            - onlyOnce
            - every24Hours
            - every3Days
            - every7Days
            - every14Days
            - every30Days
        title:
          type: string
          description: Notice title.
          minLength: 1
          maxLength: 60
          pattern: \S
        description:
          type: string
          description: Notice description.
          minLength: 1
          maxLength: 360
          pattern: \S
    CustomPatchApplicationInput:
      title: CustomPatchApplicationInput
      allOf:
        - $ref: '#/components/schemas/BasePatchApplicationInput'
        - type: object
          properties:
            urls:
              $ref: '#/components/schemas/PatchUrls'
            type:
              $ref: '#/components/schemas/CustomTypeInput'
            category:
              type: string
    CustomProfilePreferencesControl:
      title: CustomProfilePreferencesControl
      type: object
      nullable: true
      description: Apply custom browser profile preferences. Please contact Prisma Browser's support team for further guidance. When `mode` is `enabled`, `preferences` is required; when `mode` is `disabled`, `preferences` must not be set.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether custom profile preferences are applied
          enum:
            - enabled
            - disabled
        preferences:
          type: string
          description: Custom profile preferences as a JSON object (e.g. '{"homepage":"https://example.com"}'). Must be a JSON object; scalars, booleans, null, and arrays are rejected. Required when `mode` is `enabled`; must not be set when `mode` is `disabled`.
          minLength: 1
          pattern: \S
    CustomTextsControl:
      title: CustomTextsControl
      type: object
      nullable: true
      description: Customize and edit texts shown in browser dialogs and block pages.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether browser text overrides are configured
          enum:
            - customizeTexts
            - useDefaultTexts
        overrides:
          type: array
          description: List of trigger-specific text overrides. Required when mode is customizeTexts. Must not be set when mode is useDefaultTexts.
          minItems: 1
          maxItems: 300
          items:
            type: object
            additionalProperties: false
            required:
              - trigger
            properties:
              trigger:
                type: string
                description: Trigger whose default text is overridden
                minLength: 5
                maxLength: 256
              title:
                type: string
                description: Replacement title for the selected trigger
                maxLength: 80
              description:
                type: string
                description: Replacement body text for the selected trigger
                maxLength: 5000
              link:
                type: object
                description: Optional external link shown with the custom text
                additionalProperties: false
                required:
                  - label
                  - url
                properties:
                  label:
                    type: string
                    description: Link text displayed to the end user
                    minLength: 1
                    maxLength: 30
                  url:
                    type: string
                    description: Link destination URL
                    minLength: 1
                    maxLength: 2000
    CustomTypeInput:
      title: CustomTypeInput
      type: string
      description: Discriminator field, must be 'custom'.
      enum:
        - custom
    CustomizationControls:
      title: CustomizationControls
      type: object
      description: Controls for customization rules.
      minProperties: 1
      additionalProperties: false
      properties:
        adminMessages:
          $ref: '#/components/schemas/AdminMessagesControl'
        sidebar:
          $ref: '#/components/schemas/AdminSidebarManagementControl'
        autoLaunchExternalApplications:
          $ref: '#/components/schemas/AutoLaunchExternalApplicationsControl'
        automaticClientCertificateSelection:
          $ref: '#/components/schemas/AutomaticClientCertificateSelectionControl'
        backgroundImage:
          $ref: '#/components/schemas/BackgroundImageControl'
        brandColor:
          $ref: '#/components/schemas/BrandColorControl'
        browserIcon:
          $ref: '#/components/schemas/BrowserIconControl'
        companyLogo:
          $ref: '#/components/schemas/CompanyLogoControl'
        companyName:
          $ref: '#/components/schemas/CompanyNameControl'
        customBrowserPreferences:
          $ref: '#/components/schemas/CustomBrowserPreferencesControl'
        customHttpHeader:
          $ref: '#/components/schemas/CustomHttpHeaderControl'
        customNotice:
          $ref: '#/components/schemas/CustomNoticeControl'
        customProfilePreferences:
          $ref: '#/components/schemas/CustomProfilePreferencesControl'
        customTexts:
          $ref: '#/components/schemas/CustomTextsControl'
        defaultSearchProvider:
          $ref: '#/components/schemas/DefaultSearchProviderControl'
        deploymentUpgrade:
          $ref: '#/components/schemas/DeploymentUpgradeControl'
        enterpriseBrowserPolicies:
          $ref: '#/components/schemas/EnterpriseBrowserPoliciesControl'
        extensionForceInstall:
          $ref: '#/components/schemas/ExtensionForceInstallControl'
        historyCollection:
          description: Collect new users' browsing history to identify trends and support enforcement decisions based on historical data.
          allOf:
            - $ref: '#/components/schemas/EnableDisableControl'
        homePage:
          $ref: '#/components/schemas/HomePageControl'
        identityProviderSyncedShortcuts:
          $ref: '#/components/schemas/IdentityProviderSyncedShortcutsControl'
        incognito:
          $ref: '#/components/schemas/IncognitoControl'
        internalNetworkDetection:
          $ref: '#/components/schemas/InternalNetworkDetectionControl'
        managedShortcuts:
          $ref: '#/components/schemas/ManagedShortcutsControl'
        microsoftAutoSso:
          description: Enable automatic web-application user sign-in for Microsoft Entra ID accounts, based on the device signed-in account.
          allOf:
            - $ref: '#/components/schemas/EnableDisableControl'
        newTabPage:
          $ref: '#/components/schemas/NewTabPageControl'
        onBrowserStartup:
          $ref: '#/components/schemas/OnBrowserStartupControl'
        onboardingWizard:
          $ref: '#/components/schemas/OnboardingWizardControl'
        pageTranslationGoogleTranslate:
          $ref: '#/components/schemas/PageTranslationGoogleTranslateControl'
        prismaBrowserDesktopExtender:
          $ref: '#/components/schemas/PrismaBrowserLocalExtenderControl'
        profileSync:
          $ref: '#/components/schemas/ProfileSyncControl'
        proxyAutoConfigurationPacFile:
          $ref: '#/components/schemas/ProxyAutoConfigurationPacFileControl'
        realUserMonitoring:
          description: Control the use of RUM within Prisma Browser.
          allOf:
            - $ref: '#/components/schemas/EnableDisableControl'
        requestDesktopMobileSite:
          $ref: '#/components/schemas/RequestDesktopMobileSiteControl'
        searchEngineContentFiltering:
          $ref: '#/components/schemas/SearchEngineContentFilteringControl'
        searchSuggestions:
          $ref: '#/components/schemas/SearchSuggestionsControl'
        desktopSharing:
          description: Control end-user ability to share their entire desktop screen or desktop apps during video conferencing sessions via web apps such as Zoom, MS Teams, and Slack.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        suggestDefaultBrowser:
          $ref: '#/components/schemas/SuggestDefaultBrowserControl'
        themeColor:
          $ref: '#/components/schemas/ThemeColorControl'
        trafficFlow:
          $ref: '#/components/schemas/TrafficFlowControl'
        userAgent:
          $ref: '#/components/schemas/UserAgentControl'
    CustomizationResolvedRule:
      title: CustomizationResolvedRule
      description: The resolved desired state of a Customization rule, returned by create (POST 201) and full-replace (PUT 200). It mirrors the request body (scope, mode, controls) with all server-resolved defaults filled in, plus the assigned id. References are returned as IDs, not enriched with names; use GET-by-id for the enriched entity.
      type: object
      required:
        - id
        - name
        - mode
        - controls
      properties:
        id:
          type: string
          description: Unique identifier of the rule (PULID, 29 chars). In draft mode this is the entity ID.
          example: 0RL0123456789012345678901234
        name:
          type: string
          description: The name or title of the rule.
        description:
          type: string
          description: The detailed description of the rule.
        scope:
          $ref: '#/components/schemas/PostScope'
        mode:
          $ref: '#/components/schemas/RestrictedRuleMode'
        controls:
          $ref: '#/components/schemas/CustomizationControls'
    CustomizationRuleDetailed:
      title: CustomizationRuleDetailed
      description: A detailed customization rule object with complete configuration
      type: object
      required:
        - id
        - name
        - priority
        - mode
        - scope
        - metadata
      properties:
        id:
          type: string
          description: Unique identifier for the rule
        name:
          type: string
          description: User-friendly name for the rule
        priority:
          type: integer
          format: int32
          description: Order position of the rule in the list
        section:
          type: object
          nullable: true
          description: Section this rule belongs to (null if standalone)
          allOf:
            - $ref: '#/components/schemas/SectionRef'
        description:
          type: string
          description: Detailed explanation of the rule's purpose
        mode:
          $ref: '#/components/schemas/RestrictedRuleMode'
        scope:
          $ref: '#/components/schemas/GetScope'
        controls:
          $ref: '#/components/schemas/CustomizationControls'
        metadata:
          type: object
          required:
            - createdBy
            - createdTime
            - lastUpdatedBy
            - lastUpdatedTime
          properties:
            configurationVersion:
              $ref: '#/components/schemas/MetadataConfigurationVersion'
            createdBy:
              readOnly: true
              type: string
              description: Email or identifier of the admin who created the rule
            createdTime:
              readOnly: true
              type: string
              format: date-time
              description: Timestamp when the rule was created
            lastUpdatedBy:
              readOnly: true
              type: string
              description: Email or identifier of the admin who last updated the rule
            lastUpdatedTime:
              readOnly: true
              type: string
              format: date-time
              description: Timestamp when the rule was last updated
    DefaultSearchProviderControl:
      title: DefaultSearchProviderControl
      type: object
      nullable: true
      description: Control the default search engine provider for the address bar and context menu search access.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether the default search provider is managed.
          enum:
            - enable
            - disable
            - userChoice
        provider:
          type: string
          description: Search provider selection.
          enum:
            - Google
            - Bing
            - DuckDuckGo
            - Startpage
            - Custom
        providerName:
          type: string
          description: Default search provider display name.
        searchUrl:
          description: Default search provider URL template. Must be an http(s) URL (or a "{google:baseURL}" built-in template) containing the {searchTerms} placeholder.
          allOf:
            - $ref: '#/components/schemas/SearchUrl'
        recommended:
          type: boolean
          description: Whether this setting is recommended and user-changeable.
    DefinitionUpdateTimeframe:
      title: DefinitionUpdateTimeframe
      type: string
      description: Definition update timeframe
      enum:
        - 1 week
        - 2 weeks
        - 3 weeks
        - 1 month
    DeleteDevicesBadRequestResponse:
      description: Error envelope returned for 400 Bad Request from DeleteDevices. The error.code discriminates which validation failed.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          oneOf:
            - $ref: '#/components/schemas/InvalidDeviceIdError'
            - $ref: '#/components/schemas/CannotDeleteSuspendedDeviceError'
          discriminator:
            propertyName: code
            mapping:
              INVALID_DEVICE_ID: '#/components/schemas/InvalidDeviceIdError'
              CANNOT_DELETE_SUSPENDED_DEVICE: '#/components/schemas/CannotDeleteSuspendedDeviceError'
    DeploymentUpgradeControl:
      title: DeploymentUpgradeControl
      type: object
      nullable: true
      description: Select Prisma Browser upgrade channel.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Prisma Browser upgrade channel
          enum:
            - default
            - lts
            - pinned
            - noUpdates
        versionUpdateDelayDays:
          type: integer
          description: Delay in days before receiving the latest default-channel version. Applies when mode is default.
          enum:
            - 0
            - 1
            - 2
            - 3
            - 5
            - 7
        majorReleaseDelayDays:
          type: integer
          description: Delay in days before receiving the next available LTS major release. Applies when mode is lts.
          enum:
            - 0
            - 1
            - 2
            - 3
            - 5
            - 7
            - 14
            - 21
            - 28
        patchDelayDays:
          type: integer
          description: Delay in days before receiving LTS security and bug patches. Applies when mode is lts. Must be less than or equal to majorReleaseDelayDays.
          enum:
            - 0
            - 1
            - 2
            - 3
        expediteCriticalSecurityUpdates:
          type: boolean
          description: Whether critical security updates can bypass the configured delay. Applies when mode is default and versionUpdateDelayDays > 0, or mode is lts and patchDelayDays > 0. Defaults to true when applicable. Must not be set when the relevant delay is 0, or when mode is pinned or noUpdates.
        pinnedVersions:
          type: object
          description: Pinned target versions by desktop OS. Required when mode is pinned. Must not be set for other modes.
          additionalProperties: false
          required:
            - mac
            - windows
          properties:
            mac:
              type: string
              description: Pinned macOS browser version
              minLength: 1
              maxLength: 50
              pattern: ^\d+(\.\d+){0,3}$
            windows:
              type: string
              description: Pinned Windows browser version
              minLength: 1
              maxLength: 50
              pattern: ^\d+(\.\d+){0,3}$
        forceRollback:
          type: object
          description: Whether to force rollback when the pinned version is older than latest. Applies when mode is pinned. Defaults to false for both platforms when omitted.
          additionalProperties: false
          properties:
            mac:
              type: boolean
              description: Whether to force macOS instances to roll back to the pinned version
            windows:
              type: boolean
              description: Whether to force Windows instances to roll back to the pinned version
        gracePeriodHours:
          type: integer
          description: Time in hours users can defer the forced update relaunch. Applies when mode is default, lts, or pinned. Defaults to 4 when omitted. Must not be set when mode is noUpdates.
          enum:
            - 1
            - 4
            - 8
            - 12
            - 24
            - 48
            - 72
    Device:
      title: Device
      type: object
      properties:
        id:
          type: string
          description: Unique identifier
        externalId:
          type: string
          description: External identifier
        status:
          type: string
          description: Device status
          enum:
            - active
            - archived
            - suspended
        firstSeen:
          readOnly: true
          type: string
          format: date-time
          description: First seen time
        lastSeen:
          readOnly: true
          type: string
          format: date-time
          description: Last seen time
        osType:
          type: string
          description: Operating System type
          enum:
            - windows
            - macOS
            - linux
            - ios
            - android
            - unknown
        osVersion:
          type: string
          description: OS Version
        osDisplayName:
          type: string
          description: OS Display Name
        chromeosVersion:
          type: string
          description: ChromeOS version (only for ChromeOS devices)
        locationMethod:
          $ref: '#/components/schemas/LocationMethod'
        arch:
          type: string
          description: Architecture
        nativeArch:
          type: string
          description: Native Architecture
        hostname:
          type: string
          description: Hostname
        model:
          type: string
          description: Device Model
        serialNumber:
          type: string
          description: Serial Number
        mobileVendor:
          type: string
          description: Mobile device vendor/manufacturer (e.g., Samsung, Apple)
        mobileHardware:
          type: string
          description: Mobile device hardware identifier (e.g., iPhone14,2, SM-G998B)
        mobileIsRooted:
          type: boolean
          description: Whether the mobile device is rooted/jailbroken
        macAddresses:
          type: array
          items:
            type: string
          description: MAC Addresses
        screenLockStatus:
          type: string
          description: Screen Lock Status
          enum:
            - ScreenLockStatusUnknown
            - ScreenLockStatusDisabled
            - ScreenLockStatusEnabled
        diskEncryptionStatus:
          type: string
          description: Disk Encryption Status
          enum:
            - DiskEncryptionStatusUnknown
            - DiskEncryptionStatusDisabled
            - DiskEncryptionStatusEnabled
        diskEncryptionDetails:
          $ref: '#/components/schemas/DeviceDiskEncryptionDetails'
        firewallStatus:
          type: string
          description: Firewall Status
          enum:
            - FireWallStatusUnknown
            - FireWallStatusDisabled
            - FireWallStatusEnabled
        firewallDetails:
          $ref: '#/components/schemas/DeviceFirewallDetails'
        userAgent:
          type: string
          description: User Agent
        ip:
          type: string
          description: IP Address
          nullable: true
        talonExtensionVersion:
          type: string
          description: Talon Extension Version
        browserVersion:
          type: string
          description: Browser Version
        browserBrand:
          $ref: '#/components/schemas/DeviceBrowserBrand'
        deviceType:
          type: string
          description: Device Type
          enum:
            - unknown
            - desktop
            - laptop
            - vm
            - smartphone
            - tablet
            - chromebook
        platform:
          $ref: '#/components/schemas/DevicePlatform'
        deviceEPP:
          $ref: '#/components/schemas/DeviceEPP'
        devicePassword:
          $ref: '#/components/schemas/DevicePasswordPosture'
        crowdstrikeZTA:
          $ref: '#/components/schemas/CrowdstrikeZTAPosture'
        systemIntegrity:
          $ref: '#/components/schemas/SystemIntegrityPosture'
        isRunningOnRemoteSession:
          type: boolean
          description: Whether the device is running on a remote session (e.g., RDP, VNC)
        deviceManagement:
          $ref: '#/components/schemas/DeviceManagement'
        browserSelfProtectionModule:
          $ref: '#/components/schemas/BrowserSelfProtectionModule'
        isOSUserAdmin:
          type: boolean
          description: OS user is admin
        isBrowserInstalledAsAdmin:
          type: boolean
          description: Browser installed as admin
        user:
          $ref: '#/components/schemas/User'
      required:
        - id
        - status
        - firstSeen
        - lastSeen
        - osType
        - osDisplayName
        - platform
        - browserBrand
        - arch
        - nativeArch
        - hostname
        - model
        - serialNumber
        - macAddresses
        - screenLockStatus
        - diskEncryptionStatus
        - firewallStatus
        - isBrowserInstalledAsAdmin
        - userAgent
        - talonExtensionVersion
        - browserVersion
        - deviceType
        - osVersion
        - externalId
    DeviceArchiveResponse:
      title: DeviceArchiveResponse
      type: object
      properties:
        archivedDeviceIds:
          type: array
          items:
            type: string
          description: List of device IDs that were archived
        message:
          type: string
          example: 3 devices archived successfully
    DeviceBrowserBrand:
      title: DeviceBrowserBrand
      type: string
      description: Browser brand
      enum:
        - Arc
        - Brave
        - Chrome
        - Edge
        - Opera
        - Dia
        - Comet
        - Prisma Browser
        - Unknown
    DeviceDeleteResponse:
      title: DeviceDeleteResponse
      type: object
      properties:
        deletedDeviceIds:
          type: array
          items:
            type: string
          description: List of device IDs that were deleted
        message:
          type: string
          example: 3 devices deleted successfully
    DeviceDiskEncryptionDetails:
      title: DeviceDiskEncryptionDetails
      type: object
      description: Disk encryption details for the device
      required:
        - products
      properties:
        products:
          type: array
          description: List of disk encryption products detected on the device
          items:
            $ref: '#/components/schemas/DiskEncryptionProduct'
    DeviceEPP:
      title: DeviceEPP
      type: object
      required:
        - products
        - enabled
      properties:
        products:
          type: array
          items:
            $ref: '#/components/schemas/EPP'
        enabled:
          type: boolean
    DeviceFirewallDetails:
      title: DeviceFirewallDetails
      type: object
      description: Firewall details for the device
      required:
        - products
      properties:
        products:
          type: array
          description: List of firewall products detected on the device
          items:
            $ref: '#/components/schemas/FirewallProduct'
    DeviceForceReauthResponse:
      title: DeviceForceReauthResponse
      type: object
      properties:
        forcedReauthDeviceIds:
          type: array
          items:
            type: string
          description: List of device IDs that were force re-authenticated
        message:
          type: string
          example: Force re-authentication initiated for 2 devices
    DeviceGroup:
      title: DeviceGroup
      type: object
      properties:
        id:
          type: string
          description: Unique identifier
        name:
          type: string
          description: Device group name
        platform:
          $ref: '#/components/schemas/DeviceGroupPlatform'
        createdBy:
          readOnly: true
          type: string
          description: Created by user
        updatedBy:
          readOnly: true
          type: string
          description: Updated by user
        createdAt:
          readOnly: true
          type: string
          format: date-time
          description: Created at timestamp
        updatedAt:
          readOnly: true
          type: string
          format: date-time
          description: Updated at timestamp
        attributes:
          $ref: '#/components/schemas/AttributeObject'
        devices:
          type: array
          description: Device IDs in this group
          items:
            type: string
      required:
        - id
        - name
        - platform
        - createdAt
        - updatedAt
    DeviceGroupPatchRequest:
      title: DeviceGroupPatchRequest
      type: object
      properties:
        name:
          type: string
          description: Device group name
          minLength: 1
          maxLength: 255
        attributes:
          $ref: '#/components/schemas/AttributeObject'
        serialsToAdd:
          type: array
          items:
            type: string
          description: Serial numbers to add to the device group. Idempotent - adding existing serials has no effect.
          example:
            - LAPTOP001
            - LAPTOP002
            - DESKTOP001
        serialsToRemove:
          type: array
          items:
            type: string
          description: Serial numbers to remove from the device group. Idempotent - removing non-existing serials has no effect.
          example:
            - LAPTOP001
            - DESKTOP001
    DeviceGroupPlatform:
      title: DeviceGroupPlatform
      type: string
      description: Device group platform
      enum:
        - Desktop Browser
        - Mobile Browser
        - Browser Extension
        - Chromebook
    DeviceGroupRef:
      title: DeviceGroupRef
      type: object
      description: A reference to a device group entity.
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: Device group identifier
        name:
          type: string
          description: Device group name
    DeviceGroupRequest:
      title: DeviceGroupRequest
      type: object
      properties:
        name:
          type: string
          description: Device group name
          minLength: 1
          maxLength: 255
        platform:
          $ref: '#/components/schemas/DeviceGroupPlatform'
        attributes:
          $ref: '#/components/schemas/AttributeObject'
      required:
        - name
        - platform
    DeviceManagement:
      title: DeviceManagement
      type: object
      required:
        - status
        - systems
      properties:
        status:
          type: string
          enum:
            - managed
            - unmanaged
        systems:
          type: array
          description: Device Management
          items:
            $ref: '#/components/schemas/DeviceManagementSystem'
    DeviceManagementSystem:
      title: DeviceManagementSystem
      type: object
      properties:
        system:
          type: string
          enum:
            - ad
            - azureAd
            - intune
            - jamf
        details:
          type: string
    DeviceManagementSystemInput:
      title: DeviceManagementSystemInput
      type: object
      properties:
        name:
          $ref: '#/components/schemas/ManagementSystemType'
        domains:
          type: array
          items:
            type: string
      required:
        - name
    DeviceManufacturer:
      title: DeviceManufacturer
      type: string
      description: Device manufacturer
      enum:
        - Acer
        - Apple
        - Asus
        - Dell
        - HP
        - Lenovo
        - Microsoft
        - Toshiba
    DevicePasswordPosture:
      title: DevicePasswordPosture
      type: object
      required:
        - enabled
      properties:
        enabled:
          type: boolean
        passwordPolicy:
          $ref: '#/components/schemas/DevicePasswordPosturePolicy'
    DevicePasswordPosturePolicy:
      title: DevicePasswordPosturePolicy
      type: object
      required:
        - complexityReq
        - maxPasswordAge
        - minPasswordLength
      properties:
        complexityReq:
          type: boolean
        maxPasswordAge:
          type: integer
        minPasswordLength:
          type: integer
    DevicePlatform:
      title: DevicePlatform
      type: string
      description: Device platform
      enum:
        - Desktop Browser
        - Mobile Browser
        - Browser Extension
        - Unknown
    DeviceRestoreResponse:
      title: DeviceRestoreResponse
      type: object
      properties:
        restoredDeviceIds:
          type: array
          items:
            type: string
          description: List of device IDs that were restored
        message:
          type: string
          example: 3 devices restored successfully
    DeviceResumeResponse:
      title: DeviceResumeResponse
      type: object
      properties:
        resumedDeviceIds:
          type: array
          items:
            type: string
          description: List of device IDs that were resumed
        message:
          type: string
          example: 3 devices resumed successfully
    DeviceStatusChangeRequest:
      title: DeviceStatusChangeRequest
      type: object
      properties:
        deviceIds:
          type: array
          items:
            type: string
          description: List of device IDs
          minItems: 1
      required:
        - deviceIds
    DeviceSuspendResponse:
      title: DeviceSuspendResponse
      type: object
      properties:
        suspendedDeviceIds:
          type: array
          items:
            type: string
          description: List of device IDs that were suspended
        message:
          type: string
          example: 3 devices suspended successfully
    DeviceType:
      title: DeviceType
      type: string
      description: Device type
      enum:
        - chromebook
        - desktop
        - laptop
        - smartphone
        - tablet
        - unknown
        - vm
    DevicesNotFoundError:
      description: One or more of the requested devices were not found.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - DEVICES_NOT_FOUND
              description: Discriminator - always "DEVICES_NOT_FOUND".
    DevicesNotFoundResponse:
      description: Error envelope returned when one or more devices are not found.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/DevicesNotFoundError'
    DiskEncryptionProduct:
      title: DiskEncryptionProduct
      type: object
      description: Disk encryption product information
      required:
        - vendorName
        - productName
      properties:
        vendorName:
          $ref: '#/components/schemas/DiskEncryptionVendorName'
        productName:
          type: string
          description: Product name of the disk encryption product
    DiskEncryptionVendorName:
      title: DiskEncryptionVendorName
      type: string
      description: Disk encryption vendor name
      enum:
        - 2BrightSparks Pte Ltd
        - Acronis
        - Adolix
        - Apimac, software
        - Apple Inc.
        - archicrypt
        - Arcserve (USA), LLC
        - Ashampoo GmbH & Co. KG
        - AVG Technologies CZ, s.r.o.
        - Axantum Software AB
        - AxCrypt AB
        - Beachhead Solutions
        - Becrypt Ltd
        - BeLight Software Ltd.
        - Bitdefender
        - Braincell consult & research GmbH
        - Check Point Software Technologies
        - CipherShed
        - COMODO Security Solutions
        - CoSoSys Ltd.
        - CP-Lab.com
        - Crypto Systems, Inc.
        - Cypherix Software Pvt. Ltd.
        - DATEV eG
        - Dekart
        - Dell Inc.
        - Deltacrypt Technologies Inc
        - DESlock Limited
        - Digital Millenium Inc.
        - DoGoodSoft
        - EgoSecure
        - EGSoftWeb
        - ENC Security Systems
        - Encrypt4all Software
        - ESET
        - Evgeny Korovin
        - EXLADE, Inc.
        - Exosphere Labs, Inc.
        - FileEncryption.org.
        - G Data Software AG
        - GiliSoft International LLC
        - GitHub, Inc.
        - GitLab Inc.
        - Hewlett-Packard
        - Hitek Software LLC
        - HummerStudio
        - IDRIX
        - InterCrypto Ltd
        - Inv Softworks LLC
        - Jetico, Inc.
        - Kaspersky Lab
        - Kovell Ventures Ltd.
        - Kromtech
        - Kruptos 2 Software
        - Lavasoft
        - MadowSoft Software
        - Max Secure Software
        - McAfee, Inc.
        - Microsoft Corporation
        - MicroWorld Technologies Inc.
        - Mnemonic Security Inc.
        - MoRUN.net
        - MSecure Data Labs
        - NCH Software
        - New Softwares.net
        - Nomadesk NV
        - ntldr
        - Packetizer, Inc.
        - Panda Security, S.L.
        - PC Dynamics
        - PDFKey
        - PRIMX
        - R-tools Technology, Inc.
        - Ranquel Technologies
        - RentAnAdviser
        - Rogers
        - Safetica Technologies
        - Sarah Dean
        - SecurStar GmbH
        - SoftWinter
        - Solid Programs
        - Sophos Limited
        - Stoneage Softwares
        - SUSE LINUX GmbH
        - Symantec Corporation
        - TEHTRIS
        - Tesline-Service SRL
        - The Gpg4win Project
        - Trellix
        - Trend Micro, Inc.
        - TrueCrypt Foundation
        - TrustPort, a.s.
        - Utimaco Safeware AG
        - Vassil Arabadjiev
        - WARDWIZ
        - Webminds, Inc.
        - WinEncrypt
        - WinMagic Inc.
        - Zmanda, Inc.
    DlpProfileRef:
      title: DlpProfileRef
      type: object
      description: Expanded reference to an Enterprise DLP (EDLP) data profile.
      required:
        - id
        - name
      additionalProperties: false
      properties:
        id:
          type: string
          description: |
            EDLP data profile id (the external id from the Enterprise DLP API). Unlike other reference ids in this API, which are internal Prisma identifiers, this value comes from the Enterprise DLP system, so it is not interchangeable with ids returned for the same profile on other Prisma surfaces. Discover and validate profile ids via the EDLP Data Profiles API: list all with GET /v2/api/data-profiles, or fetch one with GET /v2/api/data-profiles/{resourceId}. Use this id as dlpProfileId when creating or updating a rule.
        name:
          type: string
          description: EDLP data profile display name.
    DnsOverHttpsControl:
      title: DnsOverHttpsControl
      type: object
      nullable: true
      description: Set DNS resolving on top of the HTTPS protocol, for encrypting the requests and their resolutions. resolverUrl and adnsEnabled=true are mutually exclusive.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether DNS-over-HTTPS is enabled.
          enum:
            - enable
            - disable
        failureMode:
          type: string
          description: Upon DNS-over-HTTPS resolve failure. Required when action is 'enable'.
          enum:
            - fallbackToPlainDns
            - blockOnFailure
        resolverUrl:
          type: string
          description: DNS-over-HTTPS resolver URL. Applies when action is 'enable'.
          minLength: 9
          maxLength: 2048
          pattern: ^https://[^\s<>"#@/?]+(/[^\s<>"#]*)?(\?[^\s<>"#]*)?$
    Domain:
      title: Domain
      type: string
      description: A URL pattern, hostname, or IP address (e.g. `meet.google.com`, `*.example.com`, `https://login.example.com*`, `10.0.1.1`).
      minLength: 1
      maxLength: 2048
      pattern: ^(?!(?:[Jj][Aa][Vv][Aa][Ss][Cc][Rr][Ii][Pp][Tt]|[Dd][Aa][Tt][Aa]|[Vv][Bb][Ss][Cc][Rr][Ii][Pp][Tt]|[Cc][Hh][Rr][Oo][Mm][Ee]|[Aa][Bb][Oo][Uu][Tt]|[Bb][Ll][Oo][Bb]):)[^\s<>\x00-\x1f\x7f]+$
    DraftEntityTypes:
      title: DraftEntityTypes
      type: string
      description: The kind of draft-model configuration item (entity type). Rules and sections are listed per policy type, and applications are listed by their sub-type.
      enum:
        - accessAndDataRule
        - securityRule
        - customizationRule
        - signInRule
        - accessAndDataSection
        - securitySection
        - customizationSection
        - signInSection
        - deviceGroup
        - applicationGroup
        - customApplication
        - privateApplication
        - praApplication
        - nonwebApplication
        - localDesktopApplication
        - catalogApplication
        - localDesktopCatalogApplication
        - tag
        - localUserGroup
    EPP:
      title: EPP
      type: object
      required:
        - name
        - version
        - state
      properties:
        name:
          type: string
        version:
          type: string
        state:
          type: string
    EnableDisableControl:
      title: EnableDisableControl
      type: object
      nullable: true
      description: A simple control with an enable or disable action. Re-usable by any control that only needs a binary enable/disable decision.
      required:
        - action
      properties:
        action:
          type: string
          description: The action for this control.
          enum:
            - enable
            - disable
    EnforceRedirect:
      title: EnforceRedirect
      description: |
        Redirect configuration for the 'redirect' access action. Required when action is 'redirect'.
        Matched traffic is redirected to the configured URL.
      type: object
      required:
        - url
      additionalProperties: false
      properties:
        url:
          description: The URL that matched traffic is redirected to.
          $ref: '#/components/schemas/HttpUrl'
        autoRedirect:
          type: boolean
          description: When true, the added URL opens automatically from the inform page after a few seconds, without an explicit user action.
          default: false
    EnhancedTrackingProtectionControl:
      title: EnhancedTrackingProtectionControl
      type: object
      nullable: true
      description: Manage tracking protection and cross-site tracking.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Enhanced Tracking Protection is enabled.
          enum:
            - enable
            - disable
        excludeDomains:
          type: array
          description: List of excluded domains.
          maxItems: 1000
          uniqueItems: true
          items:
            type: string
            minLength: 1
            maxLength: 2048
            pattern: \S
    EnterpriseBrowserPoliciesControl:
      title: EnterpriseBrowserPoliciesControl
      type: object
      nullable: true
      description: Apply configurations and granular settings to your managed browsers. This control allows you to implement Chromium-based policies that are not currently available as standalone controls. Admins can browse Chromium enterprise policies at https://chromeenterprise.google/policies/, choose the policy key they need, and add it to the policies array with a value matching that policy's documented schema. Prisma Browser supports a specific subset of Chromium policy types for security reasons; contact Prisma Browser support to request evaluation for an unsupported policy.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether enterprise browser policies are applied
          enum:
            - enabled
            - disabled
        policies:
          type: array
          description: Chromium enterprise browser policies to apply
          minItems: 1
          maxItems: 500
          items:
            type: object
            additionalProperties: false
            required:
              - policy
              - value
            properties:
              policy:
                type: string
                description: Policy name from the Chromium policy catalog
                minLength: 1
              value:
                description: Policy value — can be any JSON type (string, boolean, number, object, or array) matching the policy's documented schema at https://chromeenterprise.google/policies/
    EntraIdProperties:
      title: EntraIdProperties
      type: object
      nullable: true
      description: EntraID specific properties. Present only when type is entraId.
      required:
        - tenantId
        - clientId
      properties:
        tenantId:
          type: string
          description: Entra tenant ID or domain.
        clientId:
          type: string
          description: Entra application (client) ID.
    EppVendorName:
      title: EppVendorName
      type: string
      description: EPP vendor name
      enum:
        - 360.CN
        - 3R COMPANY
        - Acronis
        - adaware
        - Agnitum Ltd.
        - AhnLab, Inc.
        - ALLIT Service, LLC.
        - Amelia Dybala
        - Amzkomp
        - Antiy Labs
        - Anvisoft Inc.
        - Apple Inc.
        - Arcabit
        - Arovax Software
        - Ashampoo GmbH & Co. KG
        - AsiaInfo, Inc.
        - Atanium Software.
        - Auslogics
        - Avanquest Software
        - AVANSI Soft.
        - AVAST Software a.s.
        - Avetix S.r.l
        - AVG Technologies CZ, s.r.o.
        - Avira GmbH
        - AxBx
        - Baidu Inc.
        - Beijing Huorong Network Technology Co., Ltd.
        - Beijing Jiangmin New Sci. & Tech. Co., Ltd
        - Beijing Rising Information Technology Co., Ltd.
        - BeyondTrust, Inc.
        - Bit9, Inc.
        - Bitdefender
        - BitSecure Labs
        - Biz Secure Labs, Pvt. Ltd.
        - Bkav Corporation
        - BlazingTools Software
        - BrightFort LLC
        - Broadcom
        - BullGuard Ltd.
        - BUSY BEE COMPANY LIMITED
        - Byte Technologies LLC
        - CA, Inc.
        - Carbon Black, Inc.
        - Check Point Software Technologies
        - Chili Security
        - CHOMAR
        - Cisco Systems, Inc.
        - CJSC Returnil Software
        - CK Technologies Ltd
        - ClamWin Pty Ltd
        - Clearsight Technologies Ltd.
        - CMC InfoSec
        - Comodo Group
        - COMODO Security Solutions
        - Coranti, Inc.
        - Coro Cybersecurity
        - Crawler Group
        - CreaSoftware
        - CrowdStrike, Inc.
        - CurioLab S.M.B.A.
        - Cyber Intelligence Solution, LLC
        - CyberByte SRL
        - Cybereason
        - Cylance Inc.
        - Cynet Security LTD
        - CYSEC
        - Datalink Industrial Corporation
        - Deep Instinct Ltd
        - Defender Pro
        - Digital Guardian
        - digital-defender
        - DIY Software Inc
        - Doctor Web, Ltd.
        - DWS Technology
        - Dynamikode Software Ltd.
        - EarthLink, Inc.
        - EAV Software
        - EDELWEISS SRL
        - eEye Digital Security
        - EgoSecure
        - EGSoftWeb
        - Elasticsearch B.V.
        - Elex do Brasil Participações Ltda
        - EMCO Software
        - Emsisoft Ltd
        - Endgame, Inc.
        - Enigma Software Group USA, LLC.
        - enSilo
        - ePCheal Antivirus
        - ESET
        - eShieldAV LLC
        - Essentware S.A.
        - ESTsoft Corp.
        - Evonsoft
        - F-Secure Corporation
        - Faronics Corporation
        - Filseclab Corporation
        - FireEye, Inc.
        - Fortinet Inc.
        - Francesco Bucci
        - FRISK Software International
        - Fujitsu Services Ltd.
        - G Data Software AG
        - GEN-X Technologies
        - GFI Software Ltd.
        - Glarysoft Ltd
        - GoTo, Inc.
        - Greatis Software, LLC.
        - GridinSoft LLC.
        - Hauri, Inc.
        - HDD Labs. Inc
        - Heimdal Security
        - HP Development Company, L.P.
        - iBoostUp Pty Ltd
        - idoosoft
        - IKARUS Security Software GmbH
        - INCA Internet Co., Ltd.
        - INCA Internet Co.,Ltd.
        - InCode Solutions
        - Intego
        - IObit
        - iolo technologies, LLC
        - iS3, Inc.
        - iSheriff
        - Ivanti, Inc.
        - J2 Global, Inc
        - JAMF Software
        - K7 Computing Pvt Ltd
        - Kapha Anti-Malware, Inc.
        - Kardo Kristal
        - Kaspersky Lab
        - Kenoxis
        - Kephyr
        - Kingsoft Corporation
        - Komal Technologies.
        - Kromtech
        - LANDESK Software, Inc.
        - Lavasoft
        - Le Minh Thanh
        - LMT Technology Solutions
        - Loaris, Inc.
        - LogicNow, Inc
        - LogMeIn, Inc.
        - Lumension Security, Inc.
        - MacPaw Inc.
        - Malwarebytes Corporation
        - Max Secure Software
        - Maya Software Technologies
        - McAfee, Inc.
        - Mega HighTech S.L.
        - Microminder
        - Microsoft Corporation
        - MicroWorld Technologies Inc.
        - MINUSOFT INDIA PRIVATE LIMITED
        - Morphisec Ltd.
        - MSecure Data Labs
        - Musarubra US LLC.
        - Mysecuritywin
        - N-able Technologies Inc
        - NANO Security
        - Nerdy Nynjas
        - NETGATE Technologies s.r.o.
        - Netpia.com, Inc.
        - New Technology Wave Inc.
        - NictaTech Software
        - NIFTY Corporation
        - NinjaRMM LLC
        - Noralabs
        - Norman AS
        - Symantec Corporation
        - nProtect, Inc.
        - Old McDonald's Farm
        - OPSWAT, Inc.
        - Orbasoft ApS.
        - OSHI LIMITED
        - Palo Alto Networks, Inc.
        - Panda Security, S.L.
        - ParetoLogic, Inc.
        - PC Cleaners Inc.
        - PC Matic, Inc.
        - PC Security Shield
        - PC Tools Software
        - Pika Software (Pty) Ltd.
        - Pitiko
        - Pocket Bits LLC
        - Proland Software
        - ProtectWorks Limited
        - Qi An Xin Group
        - Qihu 360 Software Co., Ltd.
        - Qualys, Inc.
        - Quick Guard Technologies
        - Quick Heal Technologies (P) Ltd.
        - Radialpoint Inc.
        - ReaQta BV
        - Reason Labs Ltd.
        - Reason Software Company Inc.
        - REVE Systems
        - Reza Restu , Inc
        - Roboscan Inc
        - Rogers
        - Safer-Networking Ltd.
        - Sangfor Technologies Inc.
        - Scandium Security Inc.
        - SecuraShield India Pvt. Ltd.
        - SecureAge Technology
        - SecureHunter, LLC.
        - SecureMac.com, Inc.
        - Security Software Limited
        - Security Stronghold
        - SentinelOne
        - SGA SOLUTIONS
        - SHADOWDEFENDER.COM
        - ShieldApps
        - Smadsoft
        - Smart Heal
        - Sniper Corporation
        - Sniper Guard LTD
        - SolarWinds Worldwide, LLC.
        - SonicWALL L.L.C.
        - Sophos Limited
        - Sourcefire, Inc
        - SOURCENEXT CORPORATION
        - SPAMfighter ApS
        - SparkTrust
        - Stormshield
        - Sunrise Antivirus
        - SUPERAntiSpyware
        - SurfRight B.V.
        - Swiss security laboratory.
        - Systweak Inc.
        - Team Cymru, Inc.
        - TeamViewer GmbH
        - Tech Guard Technologies
        - TEHTRI-Security
        - TEHTRIS
        - Telefónica S.A.
        - TELUS
        - Tencent
        - TG Soft S.a.s.
        - Thirtyseven4
        - ThreatTrack Security, Inc.
        - Total Defense, Inc.
        - TotalAV
        - Trend Micro, Inc.
        - Trusteer Ltd.
        - TrustPort, a.s.
        - UAB RCS LT
        - Unistal Systems Pvt. Ltd.
        - Virus Chaser Information Technology co., LTD
        - VirusBlokAda Ltd.
        - VMware, Inc.
        - VoodooSoft LLC
        - Voros Innovation
        - VXPRO INC
        - WARDWIZ
        - WatchGuard Technologies Inc
        - Webroot Software, Inc.
        - WinMend
        - WinZip Computing, S.L.
        - WithSecure Corporation
        - XANALab
        - Xvirus
        - Xyvos Technologies
        - Zbshareware Lab
        - Zemana Ltd.
        - ZookaWare
        - Zugara Media
    ErrorResponse:
      title: ErrorResponse
      type: object
      required:
        - message
      properties:
        error:
          type: string
        message:
          type: string
    ExtensionForceInstallControl:
      title: ExtensionForceInstallControl
      type: object
      nullable: true
      description: Set specific extensions to be installed automatically in Prisma Browser.
      additionalProperties: false
      required:
        - extensions
      properties:
        extensions:
          type: array
          description: Extensions installed automatically in Prisma Browser
          maxItems: 100
          items:
            type: object
            additionalProperties: false
            required:
              - id
              - source
            properties:
              id:
                type: string
                description: Chrome extension ID (32 lowercase letters)
                pattern: ^[a-z]{32}$
              source:
                type: string
                description: Extension source. When customURL, sourceUrl is required and must not be set for chromeWebstore.
                enum:
                  - chromeWebstore
                  - customURL
              sourceUrl:
                type: string
                description: Custom extension package URL. Required when source is customURL. Must not be set when source is chromeWebstore.
                minLength: 1
                maxLength: 2048
              pinned:
                type: boolean
                description: Whether the extension is pinned to the toolbar
              installInIncognito:
                type: boolean
                description: Whether automatic installation extends to Incognito mode
              customConfiguration:
                type: string
                description: Custom extension configuration JSON
                maxLength: 65536
    FieldErrorDetails:
      title: FieldErrorDetails
      description: Structured context for field-level errors. Lists each offending field so a client can map the failure back to its input. Shared by FIELD_VALIDATION_ERROR (400) and FIELD_REFERENCE_NOT_FOUND (404).
      type: object
      required:
        - errors
      additionalProperties: false
      properties:
        errors:
          type: array
          minItems: 1
          description: One entry per offending field.
          items:
            type: object
            required:
              - field
              - error
            additionalProperties: false
            properties:
              index:
                type: integer
                description: Zero-based index of the failing item in the request array (e.g. the move index for PATCH). Omitted when the request is not an array.
              field:
                type: string
                description: Name of the offending field (e.g. "id", "sectionId", "subject.type").
              error:
                type: string
                description: Human-readable explanation of the field-level problem.
              value:
                type: string
                description: The offending value, when available.
    FieldReferenceNotFoundError:
      title: FieldReferenceNotFoundError
      description: A referenced rule, section, or anchor ID does not exist.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          required:
            - details
          properties:
            code:
              type: string
              enum:
                - FIELD_REFERENCE_NOT_FOUND
              description: Discriminator - always "FIELD_REFERENCE_NOT_FOUND".
            details:
              $ref: '#/components/schemas/FieldErrorDetails'
    FieldValidationError:
      title: FieldValidationError
      description: Input validation failed for one or more specific fields.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          required:
            - details
          properties:
            code:
              type: string
              enum:
                - FIELD_VALIDATION_ERROR
              description: Discriminator - always "FIELD_VALIDATION_ERROR".
            details:
              $ref: '#/components/schemas/FieldErrorDetails'
    FileDownloadControl:
      title: FileDownloadControl
      type: object
      description: Download direction settings for file protection.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: How downloads are handled. allow saves the file to the user's local disk normally. useInPrismaBrowserOnly saves the file encrypted so it can only be opened inside Prisma Browser. saveToOrganizationStorage routes the download to an organization-managed cloud storage location instead of the local disk. block prevents the download.
          enum:
            - allow
            - useInPrismaBrowserOnly
            - saveToOrganizationStorage
            - block
        cloudStorageProvider:
          type: string
          description: The cloud-storage integration (OneDrive, Google Drive, Box, etc.) that downloads are routed to. Required when action is saveToOrganizationStorage; rejected for other actions. POST/PUT send only the ID; GET responses include both the ID and a sibling cloudStorageProviderName with the resolved display name.
        cloudStorageProviderName:
          type: string
          readOnly: true
          description: Response-only. The resolved display name of the cloud-storage integration referenced by cloudStorageProvider. Omitted when the integration has been deleted or cannot be resolved.
        applyOn:
          type: string
          description: Whether the download rule applies to every file (any) or only to files that match the filters below (specific).
          enum:
            - any
            - specific
          default: any
        fileTypeFilter:
          description: Restrict the download rule to files of certain types — categories, sub-categories, or specific extensions.
          $ref: '#/components/schemas/FileTypeFilter'
        fileSizeLimit:
          description: Restrict the download rule to files above or below a size threshold.
          $ref: '#/components/schemas/FileSizeLimit'
        fileSha256Filter:
          description: Restrict the download rule to files matching specific SHA-256 hashes.
          $ref: '#/components/schemas/FileSha256Filter'
        beforeDownload:
          description: Prompt and MFA settings applied before the download is enforced.
          $ref: '#/components/schemas/BeforeFileAction'
        customDialogText:
          description: Custom text shown in the block or prompt dialog for downloads. Omit to use the default Prisma Browser copy.
          $ref: '#/components/schemas/CustomDialogText'
    FileProtectionControl:
      title: FileProtectionControl
      type: object
      nullable: true
      description: Control how files enter and leave the rule's applications. Configure fileDownload and fileUpload independently — each direction owns its action, filters, prompt, MFA setting, and custom dialog text. Replaces the legacy fileDownload and fileUpload top-level controls.
      additionalProperties: false
      minProperties: 1
      properties:
        fileDownload:
          description: Download direction — action, filters, prompt, MFA, and custom dialog text. Fully independent from fileUpload.
          $ref: '#/components/schemas/FileDownloadControl'
        fileUpload:
          description: Upload direction — action, filters, prompt, MFA, and custom dialog text. Fully independent from fileDownload.
          $ref: '#/components/schemas/FileUploadControl'
    FileSha256Filter:
      title: FileSha256Filter
      type: object
      description: Filter by SHA-256 file hashes.
      additionalProperties: false
      required:
        - operator
        - hashes
      properties:
        operator:
          type: string
          description: Whether the rule applies to files whose hash is in the list (in), or to all files except those (notIn).
          enum:
            - in
            - notIn
        hashes:
          type: array
          uniqueItems: true
          description: SHA-256 hashes of the files this rule should target — for example, hashes of known sensitive or known-good documents your organization wants to protect or whitelist. Submit hashes in any case (abc / ABC / aBc); GET responses always return lowercase.
          minItems: 1
          maxItems: 100
          items:
            type: string
            pattern: ^[a-fA-F0-9]{64}$
    FileSizeLimit:
      title: FileSizeLimit
      type: object
      description: Filter by file size threshold.
      additionalProperties: false
      required:
        - operator
        - value
        - unit
      properties:
        operator:
          type: string
          description: Whether the rule applies to files smaller than or larger than the threshold.
          enum:
            - lessThan
            - greaterThan
        value:
          type: integer
          description: The size threshold, expressed in the chosen unit. On read, value and unit are normalized to the largest unit that yields an exact integer (e.g. 1024 B is returned as 1 KB).
          minimum: 0
        unit:
          type: string
          description: Unit for value — bytes, kilobytes, megabytes, or gigabytes.
          enum:
            - B
            - KB
            - MB
            - GB
          default: KB
    FileTypeFilter:
      title: FileTypeFilter
      type: object
      description: Filter by file type — categories, sub-categories, or specific extensions.
      additionalProperties: false
      required:
        - operator
      properties:
        operator:
          type: string
          description: Whether the rule applies to files in the combined list of predefinedTypes + customExtensions (in), or to all files except those (notIn).
          enum:
            - in
            - notIn
        predefinedTypes:
          type: array
          uniqueItems: true
          description: Broad file-type buckets from the Prisma Browser catalog. Either a category (e.g., documents) or a sub-category (e.g., excel). Use this when the rule should match a whole group of files; for specific extensions, use customExtensions instead.
          maxItems: 12
          items:
            type: string
            enum:
              - documents
              - multimedia
              - webPages
              - sourceCode
              - archives
              - word
              - excel
              - powerpoint
              - other
              - video
              - audio
              - image
        customExtensions:
          type: array
          uniqueItems: true
          description: Specific file extensions — both predefined extensions from the Prisma Browser catalog (e.g., pdf, docx) and your own proprietary or rare formats (e.g., xyz). All extensions live in this single array regardless of catalog membership.
          maxItems: 50
          items:
            type: string
            pattern: ^\w+$
            maxLength: 15
    FileUploadControl:
      title: FileUploadControl
      type: object
      description: Upload direction settings for file protection.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: How uploads are handled. allow lets any file be uploaded to the rule's apps. allowProtectedBetweenRuleApps lets a user upload only Prisma-protected files that were previously downloaded from one of this rule's web applications — keeping protected content moving only between apps that share the same scope. Requires fileDownload.action=useInPrismaBrowserOnly on a matching rule. blockOnlyProtected is the inverse — ordinary files upload normally but protected files are blocked. block prevents all uploads.
          enum:
            - allow
            - allowProtectedBetweenRuleApps
            - blockOnlyProtected
            - block
        applyOn:
          type: string
          description: Whether the upload rule applies to every file (any) or only to files that match the filters below (specific).
          enum:
            - any
            - specific
          default: any
        fileTypeFilter:
          description: Restrict the upload rule to files of certain types — categories, sub-categories, or specific extensions.
          $ref: '#/components/schemas/FileTypeFilter'
        fileSizeLimit:
          description: Restrict the upload rule to files above or below a size threshold.
          $ref: '#/components/schemas/FileSizeLimit'
        fileSha256Filter:
          description: Restrict the upload rule to files matching specific SHA-256 hashes.
          $ref: '#/components/schemas/FileSha256Filter'
        beforeUpload:
          description: Prompt and MFA settings applied before the upload is enforced.
          $ref: '#/components/schemas/BeforeFileAction'
        customDialogText:
          description: Custom text shown in the block or prompt dialog for uploads. Omit to use the default Prisma Browser copy.
          $ref: '#/components/schemas/CustomDialogText'
    FirewallProduct:
      title: FirewallProduct
      type: object
      description: Firewall product information
      required:
        - vendorName
        - productName
        - enabled
      properties:
        vendorName:
          $ref: '#/components/schemas/FirewallVendorName'
        productName:
          type: string
          description: Product name of the firewall
        enabled:
          type: boolean
          description: Whether the firewall is enabled
    FirewallVendorName:
      title: FirewallVendorName
      type: string
      description: Firewall vendor name
      enum:
        - Agnitum Ltd.
        - NETGATE Technologies s.r.o.
        - ParetoLogic, Inc.
        - LANDESK Software, Inc.
        - AT&T
        - Bitdefender
        - Mysecuritywin
        - G Data Software AG
        - Max Secure Software
        - AhnLab, Inc.
        - AVG Technologies CZ, s.r.o.
        - Symantec Corporation
        - Kaspersky Lab
        - Avira GmbH
        - Panda Security, S.L.
        - Webroot Software, Inc.
        - Quick Heal Technologies (P) Ltd.
        - nProtect, Inc.
        - F-Secure Corporation
        - ThreatTrack Security, Inc.
        - McAfee, Inc.
        - eEye Digital Security
        - Arcabit
        - BeyondTrust, Inc.
        - Telefónica S.A.
        - GEN-X Technologies
        - K7 Computing Pvt Ltd
        - Faronics Corporation
        - TELUS
        - Kingsoft Corporation
        - BiniSoft.org
        - GFI Software Ltd.
        - TG Soft S.a.s.
        - Scandium Security Inc.
        - Datpol
        - Tech Guard Technologies
        - NCP engineering GmbH
        - SoftSphere Technologies
        - Quick Guard Technologies
        - Emsisoft Ltd
        - Datalink Industrial Corporation
        - COMODO Security Solutions
        - MicroWorld Technologies Inc.
        - AVAST Software a.s.
        - ESET
        - Beijing Rising Information Technology Co., Ltd.
        - Smart Heal
        - Rogers
        - Check Point Software Technologies
        - CellSecurity
        - AS3 Soft4U
        - Ates Software & Internet Technologies
        - MSecure Data Labs
        - SGA SOLUTIONS
        - ALLIT Service, LLC.
        - adaware
        - SentinelOne
        - CrowdStrike, Inc.
        - CSIS Security Group
        - SOURCENEXT CORPORATION
        - Microsoft Corporation
        - SecureMix LLC
        - Swiss security laboratory.
        - AsiaInfo, Inc.
        - INCA Internet Co., Ltd.
        - ESTsoft Corp.
        - Sunrise Antivirus
        - Hauri, Inc.
        - SecuraShield India Pvt. Ltd.
        - NIFTY Corporation
        - Trend Micro, Inc.
        - Fujitsu Services Ltd.
        - LogMeIn, Inc.
        - Stormshield
        - Palo Alto Networks, Inc.
        - Chili Security
        - Sophos Limited
        - NortonLifeLock Inc
        - Massachusetts Institute of Technology
        - WatchGuard Technologies Inc
        - Beijing Huorong Network Technology Co., Ltd.
        - Le Minh Thanh
        - Qi An Xin Group
        - Avast Software s.r.o.
        - TEHTRIS
        - Avira Operations GmbH & Co. KG
        - WithSecure Corporation
        - Musarubra US LLC.
        - GoTo, Inc.
        - INCA Internet Co.,Ltd.
        - SECURA WEB DATA LABS PVT LTD
        - Broadcom
        - Gen Digital Inc.
        - Actipace Private Limited
        - Siyano Labs Pvt. Ltd.
        - Bkav Corporation
        - CMC InfoSec
        - Total Defense, Inc.
        - TrustPort, a.s.
        - Fortinet Inc.
        - Avanquest Software
        - Doctor Web, Ltd.
        - Security Software Limited
        - BullGuard Ltd.
        - HDD Labs. Inc
        - EarthLink, Inc.
        - Roboscan Inc
        - Thirtyseven4
        - PC Security Shield
        - CA, Inc.
        - Privacyware/PWI, Inc.
        - Károly Pados
        - PeerBlock, LLC
        - ProgrammerWorld.Net
        - Jetico, Inc.
        - Tiny Software Inc.
        - Sphinx Software
        - Defender Pro
        - Soft4Ever
        - Lavasoft
        - Norman AS
        - PC Tools Software
        - Apple Inc.
    FlushBrowserDataControl:
      title: FlushBrowserDataControl
      type: object
      nullable: true
      description: Set temporary browser sessions, so browser data will be cleaned upon close or time period.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Flush Browser Data is enabled.
          enum:
            - enable
            - disable
        trigger:
          type: string
          description: Operating mode for Flush Browser Data. Required when action is 'enable'.
          enum:
            - timePeriod
            - browserClose
        dataTypes:
          type: array
          description: Browser data types to clear. At least one must be selected when action is 'enable'.
          minItems: 1
          maxItems: 8
          uniqueItems: true
          items:
            type: string
            enum:
              - browsingHistory
              - downloadHistory
              - cookiesAndSiteData
              - cachedContent
              - savedPasswords
              - autofillData
              - siteSettings
              - webAppData
        intervalHours:
          type: integer
          format: int32
          description: Time period in hours. Required when trigger is 'timePeriod'. Applies when action is 'enable'.
          minimum: 1
          maximum: 24
    ForbiddenError:
      title: ForbiddenError
      description: The caller is not allowed to perform this action.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - FORBIDDEN
              description: Discriminator - always "FORBIDDEN".
      example:
        code: FORBIDDEN
        message: The caller is not allowed to perform this action.
        timestamp: '2026-01-01T00:00:00Z'
    ForbiddenResponse:
      title: ForbiddenResponse
      description: Error envelope returned for 403 Forbidden responses.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/ForbiddenError'
    ForceHttpsControl:
      title: ForceHttpsControl
      type: object
      nullable: true
      description: Force using HTTPS instead of HTTP to reduce the risk of MitM attacks and sending sensitive information in cleartext.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Force HTTPS is enabled.
          enum:
            - enable
            - disable
        excludedDomains:
          type: array
          uniqueItems: true
          description: Domains excluded from forced HTTPS.
          maxItems: 1000
          items:
            $ref: '#/components/schemas/Domain'
    ForceReauthDevicesBadRequestResponse:
      description: Error envelope returned for 400 Bad Request from ForceReauthDevices. The error.code discriminates which validation failed.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          oneOf:
            - $ref: '#/components/schemas/InvalidDeviceIdError'
            - $ref: '#/components/schemas/MaxDevicesExceededError'
          discriminator:
            propertyName: code
            mapping:
              INVALID_DEVICE_ID: '#/components/schemas/InvalidDeviceIdError'
              MAX_DEVICES_EXCEEDED: '#/components/schemas/MaxDevicesExceededError'
    FormLoginControl:
      title: FormLoginControl
      type: object
      nullable: true
      additionalProperties: false
      description: Control logging in to applications and websites via Prisma Browser.
      required:
        - action
      properties:
        action:
          type: string
          description: Login restriction for form-based logins.
          enum:
            - allowAll
            - allowSpecificDomains
            - blockAll
            - blockSpecificDomains
        domains:
          type: array
          uniqueItems: true
          description: Email domains the action applies to (e.g. "@company.com"). Each entry must be an '@' followed by a domain name of up to 255 characters including a top-level domain. Underscores are allowed. No label before the final two may end in "www", because a domain already covers its subdomains. Internationalized domains must be punycode-encoded (e.g. "@xn--mnchen-3ya.de").
          items:
            type: string
            minLength: 1
            pattern: ^@[^@]+$
        userPrompt:
          description: 'How the user is prompted before the app login restriction is applied. durationMinutes is accepted for every mode except none: it sets how long the user''s own bypass lasts as well as how long an admin approval stays valid. Supported values run from ''10'' (10 minutes) to ''129600'' (90 days), matching the dashboard; ''0'' is rejected.'
          $ref: '#/components/schemas/UserPrompt'
        mfaRequired:
          type: boolean
          description: Whether the user must complete an MFA challenge before login is allowed.
        accountProtection:
          type: boolean
          description: Whether account protection is enabled.
        sharedAccountProtection:
          type: boolean
          description: Whether the same protection secret is reused across all applications in the rule's scope. Requires accountProtection=true.
        customDialogText:
          $ref: '#/components/schemas/CustomDialogText'
    FormSubmissionControl:
      title: FormSubmissionControl
      type: object
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Action for the form submission control.
          enum:
            - enable
            - disable
        allowLoginForms:
          type: boolean
          description: Allow login forms to function. Only relevant when action is enable.
        customDialogText:
          $ref: '#/components/schemas/CustomDialogText'
    GenAIPromptControl:
      title: GenAIPromptControl
      type: object
      description: Control submission of data to Generative AI via forms.
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to allow or block submission of data to Generative AI applications via web forms.
          enum:
            - allow
            - block
        customDialogText:
          description: Custom text shown in the blocked prompt dialog. Only valid when action is block.
          $ref: '#/components/schemas/CustomDialogText'
    GetScope:
      title: GetScope
      type: object
      required:
        - users
        - deviceGroups
        - publicIps
        - privateIps
        - locations
      properties:
        users:
          type: object
          description: The users or user groups the rule applies to.
          required:
            - isAny
            - users
            - userGroups
          properties:
            isAny:
              type: boolean
              description: Flag indicating if any users or user groups are included in the scope.
            users:
              type: array
              description: Users the rule applies to. [] = any user, [{id, name, email}] = specific users
              items:
                $ref: '#/components/schemas/UserRef'
            userGroups:
              type: array
              description: User groups the rule applies to. [] = any group, [{id, name}] = specific groups
              items:
                $ref: '#/components/schemas/UserGroupRef'
        deviceGroups:
          type: object
          description: The device groups the rule applies to.
          required:
            - isAny
            - deviceGroups
          properties:
            isAny:
              type: boolean
              description: Flag indicating if any device groups are included in the scope.
            deviceGroups:
              type: array
              description: Device groups the rule applies to.
              items:
                $ref: '#/components/schemas/DeviceGroupRef'
        publicIps:
          type: object
          description: The public IP addresses the rule applies to.
          required:
            - isAny
            - publicIps
          properties:
            isAny:
              type: boolean
              description: Flag indicating if any public IP addresses are included in the scope.
            publicIps:
              type: array
              uniqueItems: true
              nullable: true
              description: Public IP addresses affected by the rule.
              items:
                type: string
        privateIps:
          type: object
          description: The private IP addresses the rule applies to.
          required:
            - isAny
            - privateIps
          properties:
            isAny:
              type: boolean
              description: Flag indicating if any private IP addresses are included in the scope.
            privateIps:
              type: array
              uniqueItems: true
              nullable: true
              description: Private IP addresses affected by the rule.
              items:
                type: string
        locations:
          type: object
          description: The locations the rule applies to.
          required:
            - isAny
            - locations
          properties:
            isAny:
              type: boolean
              description: Flag indicating if any locations are included in the scope.
            locations:
              type: array
              uniqueItems: true
              description: Geographical locations to which the rule applies.
              items:
                $ref: '#/components/schemas/Locations'
    GitHubTenantCondition:
      title: GitHubTenantCondition
      type: object
      properties:
        accountIds:
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 100
          minItems: 1
          maxItems: 100
          description: List of allowed GitHub account IDs
      required:
        - accountIds
      additionalProperties: false
    GoogleCloudConsoleTenantCondition:
      title: GoogleCloudConsoleTenantCondition
      type: object
      properties:
        domains:
          type: array
          uniqueItems: true
          items:
            type: string
            pattern: ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$
            maxLength: 2048
            description: Valid domain name (e.g., example.com, sub.example.com)
          minItems: 1
          maxItems: 100
          description: List of allowed Google Cloud Console domains
      required:
        - domains
      additionalProperties: false
    GoogleProperties:
      title: GoogleProperties
      type: object
      nullable: true
      description: Google Drive specific properties. Present only when type is google.
      required:
        - emailAddress
      properties:
        emailAddress:
          type: string
          description: Google Workspace admin email for domain-wide delegation.
    GoogleTenantCondition:
      title: GoogleTenantCondition
      type: object
      properties:
        domains:
          type: array
          uniqueItems: true
          items:
            type: string
            pattern: ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$
            maxLength: 2048
            description: Valid domain name (e.g., example.com, sub.example.com)
          minItems: 1
          maxItems: 100
          description: List of allowed Google domains
      required:
        - domains
      additionalProperties: false
    HomePageControl:
      title: HomePageControl
      type: object
      nullable: true
      description: Set the target page when a user clicks the Home Page button.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Home Page button mode.
          enum:
            - userChoice
            - default
            - customUrl
        customUrl:
          description: Custom Home Page URL. An http(s) URL or a schemeless host.
          allOf:
            - $ref: '#/components/schemas/WebUrl'
        showHomePageButton:
          type: boolean
          description: Whether to always show the Home Page button.
        recommended:
          type: boolean
          description: Whether to make this Home Page setting recommended and user-changeable.
    HttpHeaderName:
      title: HttpHeaderName
      type: string
      description: HTTP header name. Must contain only alphanumeric characters, underscores, and hyphens (mirrors the dashboard wizard charset).
      minLength: 1
      maxLength: 256
      pattern: ^[A-Za-z0-9_-]+$
    HttpHeaderValue:
      title: HttpHeaderValue
      type: string
      description: HTTP header value. Allowed characters mirror the dashboard wizard's punctuation allowlist; CR, LF, and other control characters are rejected.
      minLength: 1
      maxLength: 1024
      pattern: ^(?=.*\S)[\w :;.,\\/"'?!(){}\[\]@<>=\-+*#$&`|~^%]+$
    HttpUrl:
      title: HttpUrl
      type: string
      description: An HTTP or HTTPS URL.
      maxLength: 2000
      pattern: ^https?://
    IPArray:
      title: IPArray
      type: array
      uniqueItems: true
      nullable: true
      maxItems: 1000
      items:
        type: string
        pattern: ^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\/([8-9]|[1-2][0-9]|3[0-2]))?$
    IdentityProviderSyncedShortcutsControl:
      title: IdentityProviderSyncedShortcutsControl
      type: object
      nullable: true
      description: Display a user's IDP synced company assigned applications as shortcuts on their New Tab page.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether IDP-synced shortcuts are displayed.
          enum:
            - enabled
            - disabled
        idpProvider:
          type: string
          description: Identity provider used for synced shortcuts.
        idpAppsProviderId:
          type: string
          description: Entra ID integration used to sync application shortcuts.
    IdpApplicationSyncProvider:
      title: IdpApplicationSyncProvider
      type: object
      description: An IDP Application Sync provider integration.
      required:
        - id
        - displayName
        - type
        - status
      properties:
        id:
          type: string
          description: Unique identifier for the provider.
        displayName:
          type: string
          description: Human-readable name for the provider.
        type:
          $ref: '#/components/schemas/IdpApplicationSyncProviderType'
        status:
          $ref: '#/components/schemas/IdpApplicationSyncProviderStatus'
        entraId:
          $ref: '#/components/schemas/EntraIdProperties'
    IdpApplicationSyncProviderStatus:
      title: IdpApplicationSyncProviderStatus
      type: string
      description: Live connectivity status of the IDP Application Sync provider.
      enum:
        - connected
        - disconnected
    IdpApplicationSyncProviderType:
      title: IdpApplicationSyncProviderType
      type: string
      description: The IDP Application Sync provider type.
      enum:
        - entraId
    IdpLoginControl:
      title: IdpLoginControl
      type: object
      nullable: true
      description: Control identity-provider (SSO/SAML) logins via Prisma Browser.
      required:
        - action
      properties:
        action:
          type: string
          description: Login restriction for identity-provider (SSO/SAML) logins.
          enum:
            - allowAll
            - allowSpecific
            - blockAll
            - blockSpecific
        providers:
          type: array
          uniqueItems: true
          description: Identity-provider domains the action applies to (e.g. "okta.com"). Required when action is 'allowSpecific' or 'blockSpecific'. Each entry may be at most 255 characters, measured after surrounding whitespace is stripped.
          items:
            type: string
            minLength: 1
        userPrompt:
          description: 'How the user is prompted before the SSO login restriction is applied. durationMinutes is accepted for every mode except none: it sets how long the user''s own bypass lasts as well as how long an admin approval stays valid. Supported values run from ''10'' (10 minutes) to ''129600'' (90 days), matching the dashboard; ''0'' is rejected.'
          $ref: '#/components/schemas/UserPrompt'
        customDialogText:
          $ref: '#/components/schemas/CustomDialogText'
    IncognitoControl:
      title: IncognitoControl
      type: object
      nullable: true
      description: Control the ability to open Prisma Browser in Incognito mode.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          enum:
            - allow
            - block
            - force
          description: Whether to configure Incognito
    IncompleteArrayError:
      title: IncompleteArrayError
      description: The submitted positions array omits existing rules or sections.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          required:
            - details
          properties:
            code:
              type: string
              enum:
                - INCOMPLETE_ARRAY
              description: Discriminator - always "INCOMPLETE_ARRAY".
            details:
              $ref: '#/components/schemas/IncompleteArrayErrorDetails'
    IncompleteArrayErrorDetails:
      title: IncompleteArrayErrorDetails
      description: Structured context for an incomplete positions array. Lists the existing rules and sections that were omitted from the submitted array.
      type: object
      required:
        - missingRules
        - missingSections
      additionalProperties: false
      properties:
        missingRules:
          type: array
          description: IDs of existing rules missing from the submitted array.
          items:
            type: string
        missingSections:
          type: array
          description: IDs of existing sections missing from the submitted array.
          items:
            type: string
    InternalError:
      title: InternalError
      description: An unexpected internal server error occurred.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - INTERNAL_ERROR
              description: Discriminator - always "INTERNAL_ERROR".
    InternalErrorResponse:
      title: InternalErrorResponse
      description: Error envelope returned for 500 Internal Server Error responses.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/InternalError'
    InternalNetworkDetectionControl:
      title: InternalNetworkDetectionControl
      type: object
      nullable: true
      description: Configure internal network detection to ensure traffic is routed in an optimal way.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether internal network detection is enabled.
          enum:
            - enabled
            - disabled
        hostDetection:
          type: object
          description: Host-based internal network detection settings.
          additionalProperties: false
          required:
            - fqdn
            - expectedIpAddresses
          properties:
            fqdn:
              type: string
              description: Internal-only FQDN to resolve.
              minLength: 1
            expectedIpAddresses:
              type: array
              uniqueItems: true
              items:
                type: string
              description: Expected IPv4 addresses for the resolved FQDN.
              minItems: 1
        agentDetection:
          type: boolean
          description: Whether to detect GlobalProtect or Prisma Access agent presence.
    InternetExplorerCompatibilityModeControl:
      title: InternetExplorerCompatibilityModeControl
      type: object
      nullable: true
      description: Allow access to legacy websites using Internet Explorer compatibility mode.
      additionalProperties: false
      required:
        - sites
      properties:
        sites:
          type: array
          nullable: true
          description: List of site entries, each pairing a URL pattern with an optional IE document mode. To clear the control, send either null or an empty array []; both mean no compatibility mode sites.
          maxItems: 1000
          items:
            type: object
            additionalProperties: false
            required:
              - url
            properties:
              url:
                type: string
                description: 'URL match pattern in Chrome format: scheme://host[:port]/path. Allowed schemes: *, http, https. Host wildcards only as * or *. prefix. Port must be * or 0–65535. Path required (at least /*).'
                minLength: 1
                maxLength: 2048
                pattern: \S
              documentMode:
                type: string
                description: IE document mode for rendering the site
                enum:
                  - IE7
                  - IE7 Edge
                  - IE8
                  - IE8 Edge
                  - IE9
                  - IE9 Edge
                  - IE10
                  - IE10 Edge
                  - IE11
                  - IE11 Edge
    InvalidDeviceIdError:
      description: One or more supplied device IDs are invalid.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - INVALID_DEVICE_ID
              description: Discriminator - always "INVALID_DEVICE_ID".
    InvalidStatusTransitionError:
      description: The requested device status transition is not allowed.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - INVALID_STATUS_TRANSITION
              description: Discriminator - always "INVALID_STATUS_TRANSITION".
    InvalidUserIdError:
      description: One or more supplied user IDs are invalid.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - INVALID_USER_ID
              description: Discriminator - always "INVALID_USER_ID".
    IssuerCertificate:
      title: IssuerCertificate
      type: object
      properties:
        DN:
          $ref: '#/components/schemas/CertificateDN'
        serialNumber:
          type: string
        raw:
          type: string
      required:
        - DN
        - serialNumber
        - raw
    JavaScriptV8JitAndWebAssemblyControl:
      title: JavaScriptV8JitAndWebAssemblyControl
      type: object
      nullable: true
      description: Block JavaScript v8 JIT to reduce exploitation risks and to activate vulnerability mitigation techniques.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: JavaScript v8 JIT protection level.
          enum:
            - enable
            - disableAdvancedOptimizations
        excludedDomains:
          type: array
          uniqueItems: true
          description: Domains excluded from the restriction.
          maxItems: 1000
          items:
            type: string
            minLength: 1
            maxLength: 2048
            pattern: \S
    KerberosDelegationAllowlistControl:
      title: KerberosDelegationAllowlistControl
      type: object
      nullable: true
      description: List the hosts that may forward a user's Kerberos ticket to downstream services.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to allow or block Kerberos Delegation Allowlist.
          enum:
            - allow
            - block
        includedDomains:
          type: array
          description: Include specific domains.
          maxItems: 1000
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Domain'
    KeyloggingProtectionControl:
      title: KeyloggingProtectionControl
      type: object
      nullable: true
      description: Prevent keyloggers from capturing user input while using the browser (Windows only).
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Keylogging Protection is enabled.
          enum:
            - enable
            - disable
    LastDefinitionUpdateAttribute:
      title: LastDefinitionUpdateAttribute
      type: object
      properties:
        enabled:
          type: boolean
        timeframe:
          $ref: '#/components/schemas/DefinitionUpdateTimeframe'
      required:
        - enabled
        - timeframe
    LaunchingExternalApplicationsControl:
      title: LaunchingExternalApplicationsControl
      type: object
      nullable: true
      description: Configure the default behavior when users click links that launch external applications. You can then define exceptions for specific applications.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Launching External Applications action
          enum:
            - alwaysAllow
            - alwaysBlock
            - askUser
        exceptions:
          type: array
          description: Application-specific launch handling exceptions.
          maxItems: 256
          items:
            type: object
            additionalProperties: false
            required:
              - name
              - action
              - protocolSchemes
            properties:
              name:
                type: string
                minLength: 1
                maxLength: 256
                pattern: \S
              action:
                type: string
                enum:
                  - alwaysAllow
                  - alwaysBlock
                  - askUser
              protocolSchemes:
                type: array
                minItems: 1
                maxItems: 256
                uniqueItems: true
                items:
                  type: string
                  description: URL launch scheme in the form `<scheme>://` or `<scheme>://<domain>/` or a bare scheme name. Examples - `zoom://`, `zoommtg://example.com/`, `zoom`.
                  minLength: 1
                  maxLength: 2048
                  pattern: ^((?!://)\S)+(:(//(([^/]+)/)?)?|[^\s:]*)?$
    LegacyPasswordManagerControl:
      title: LegacyPasswordManagerControl
      type: object
      nullable: true
      description: Enable the Prisma Access Browser legacy password manager for managing and securing company passwords and secrets.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Legacy Password Manager is enabled.
          enum:
            - enable
            - disable
        mfaRequired:
          type: boolean
          description: Whether MFA is required before accessing stored passwords.
        mfaPromptFrequencyMinutes:
          type: integer
          format: int32
          description: How many minutes before the user must complete MFA again. Use 0 to require MFA every time.
          enum:
            - 0
            - 1
            - 2
            - 5
            - 10
            - 20
            - 30
        disablePasswordExport:
          type: boolean
          description: Whether users are prevented from exporting saved logins. Only allowed when action is 'disable'. Must not be set when action is 'enable'.
    LinuxDistro:
      title: LinuxDistro
      type: string
      description: Linux distribution
      enum:
        - Ubuntu
        - Fedora
        - Igel
    LinuxVersion:
      title: LinuxVersion
      type: object
      properties:
        enabled:
          type: boolean
        distro:
          $ref: '#/components/schemas/LinuxDistro'
        minVersion:
          type: string
          description: Minimum Linux version (e.g., "20.04" for Ubuntu, "33" for Fedora)
      required:
        - enabled
    LinuxVersionAttribute:
      title: LinuxVersionAttribute
      type: object
      properties:
        any:
          type: boolean
          description: Accept any Linux version
          default: false
        versions:
          type: array
          items:
            $ref: '#/components/schemas/LinuxVersion'
          description: List of specific Linux distributions and versions to check for
    LivePageScanningControl:
      title: LivePageScanningControl
      type: object
      description: Prevent Exposure to malicious pages using real-time page scanning, powered by Prisma Browser's Advanced Web Protection.
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether real-time live page scanning is enabled.
          enum:
            - enable
            - disable
        customDialogText:
          description: Custom text shown in the live-page-scanning block dialog. Only valid when action is enable.
          $ref: '#/components/schemas/CustomDialogText'
    LocalDesktopAppExecutable:
      title: LocalDesktopAppExecutable
      type: object
      description: Local Desktop Application Executable
      properties:
        originalFileName:
          type: string
          description: The original executable file name
      required:
        - originalFileName
    LocalDesktopAppExecutableInput:
      title: LocalDesktopAppExecutableInput
      type: object
      properties:
        originalFileName:
          type: string
          description: The original executable file name
      required:
        - originalFileName
    LocalDesktopAppExecutables:
      title: LocalDesktopAppExecutables
      type: object
      description: Local Desktop Application Executables
      properties:
        data:
          type: array
          description: List of executables for the local desktop application
          items:
            $ref: '#/components/schemas/LocalDesktopAppExecutable'
      required:
        - data
    LocalDesktopAppExecutablesInput:
      title: LocalDesktopAppExecutablesInput
      type: object
      properties:
        data:
          type: array
          description: List of executables for the local desktop application
          items:
            $ref: '#/components/schemas/LocalDesktopAppExecutableInput'
          minItems: 1
          maxItems: 50
      required:
        - data
    LocalDesktopApplicationInput:
      title: LocalDesktopApplicationInput
      allOf:
        - $ref: '#/components/schemas/BaseApplicationInput'
        - type: object
          properties:
            type:
              $ref: '#/components/schemas/LocalDesktopTypeInput'
            executables:
              $ref: '#/components/schemas/LocalDesktopAppExecutablesInput'
            category:
              type: string
          required:
            - executables
    LocalDesktopCatalogApplication:
      title: LocalDesktopCatalogApplication
      description: Local Desktop Catalog Application
      type: object
      allOf:
        - $ref: '#/components/schemas/BaseLocalDesktopApplication'
        - type: object
          properties:
            type:
              type: string
              description: Discriminator field, must be 'localdesktopcatalog'.
              enum:
                - localdesktopcatalog
    LocalDesktopCustomApplication:
      title: LocalDesktopCustomApplication
      description: Local Desktop Custom Application
      type: object
      allOf:
        - $ref: '#/components/schemas/BaseLocalDesktopApplication'
        - type: object
          properties:
            type:
              type: string
              description: Discriminator field, must be 'localdesktopcustom'.
              enum:
                - localdesktopcustom
    LocalDesktopPatchApplicationInput:
      title: LocalDesktopPatchApplicationInput
      allOf:
        - $ref: '#/components/schemas/BasePatchApplicationInput'
        - type: object
          properties:
            type:
              $ref: '#/components/schemas/LocalDesktopTypeInput'
            executables:
              $ref: '#/components/schemas/LocalDesktopAppExecutablesInput'
            category:
              type: string
    LocalDesktopTypeInput:
      title: LocalDesktopTypeInput
      type: string
      description: Discriminator field, must be 'localdesktopcustom'.
      enum:
        - localdesktopcustom
    LocalNetworkAccessRestrictionsControl:
      title: LocalNetworkAccessRestrictionsControl
      type: object
      nullable: true
      description: Manage website access to local network endpoints.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether local network access is enabled.
          enum:
            - enable
            - disable
        allowList:
          type: array
          description: Auto Allow Local Network Access List.
          maxItems: 1000
          uniqueItems: true
          items:
            type: string
            minLength: 1
            maxLength: 2048
            pattern: \S
        blockList:
          type: array
          description: Block Local Network Access List.
          maxItems: 1000
          uniqueItems: true
          items:
            type: string
            minLength: 1
            maxLength: 2048
            pattern: \S
    LocationMethod:
      title: LocationMethod
      type: string
      description: Location detection method
      enum:
        - GeoIp
        - Location services
        - Unknown
    Locations:
      title: Locations
      type: string
      description: The name of the location.
      enum:
        - AF
        - AX
        - AL
        - DZ
        - AS
        - AD
        - AO
        - AI
        - AQ
        - AG
        - AR
        - AM
        - AW
        - AU
        - AT
        - AZ
        - BS
        - BH
        - BD
        - BB
        - BY
        - BE
        - BZ
        - BJ
        - BM
        - BT
        - BO
        - BQ
        - BA
        - BW
        - BV
        - BR
        - IO
        - BN
        - BG
        - BF
        - BI
        - CV
        - KH
        - CM
        - CA
        - KY
        - CF
        - TD
        - CL
        - CN
        - CX
        - CC
        - CO
        - KM
        - CG
        - CD
        - CK
        - CR
        - CI
        - HR
        - CU
        - CW
        - CY
        - CZ
        - DK
        - DJ
        - DM
        - DO
        - EC
        - EG
        - SV
        - GQ
        - ER
        - EE
        - SZ
        - ET
        - FK
        - FO
        - FJ
        - FI
        - FR
        - GF
        - PF
        - TF
        - GA
        - GM
        - GE
        - DE
        - GH
        - GI
        - GR
        - GL
        - GD
        - GP
        - GU
        - GT
        - GG
        - GN
        - GW
        - GY
        - HT
        - HM
        - VA
        - HN
        - HK
        - HU
        - IS
        - IN
        - ID
        - IR
        - IQ
        - IE
        - IM
        - IL
        - IT
        - JM
        - JP
        - JE
        - JO
        - KZ
        - KE
        - KI
        - KP
        - KR
        - KW
        - KG
        - LA
        - LV
        - LB
        - LS
        - LR
        - LY
        - LI
        - LT
        - LU
        - MO
        - MG
        - MW
        - MY
        - MV
        - ML
        - MT
        - MH
        - MQ
        - MR
        - MU
        - YT
        - MX
        - FM
        - MD
        - MC
        - MN
        - ME
        - MS
        - MA
        - MZ
        - MM
        - NA
        - NR
        - NP
        - NL
        - NC
        - NZ
        - NI
        - NE
        - NG
        - NU
        - NF
        - MK
        - MP
        - 'NO'
        - OM
        - PK
        - PW
        - PS
        - PA
        - PG
        - PY
        - PE
        - PH
        - PN
        - PL
        - PT
        - PR
        - QA
        - RE
        - RO
        - RU
        - RW
        - BL
        - SH
        - KN
        - LC
        - MF
        - PM
        - VC
        - WS
        - SM
        - ST
        - SA
        - SN
        - RS
        - SC
        - SL
        - SG
        - SX
        - SK
        - SI
        - SB
        - SO
        - ZA
        - GS
        - SS
        - ES
        - LK
        - SD
        - SR
        - SJ
        - SE
        - CH
        - SY
        - TW
        - TJ
        - TZ
        - TH
        - TL
        - TG
        - TK
        - TO
        - TT
        - TN
        - TR
        - TM
        - TC
        - TV
        - UG
        - UA
        - AE
        - GB
        - US
        - UM
        - UY
        - UZ
        - VU
        - VE
        - VN
        - VG
        - VI
        - WF
        - EH
        - YE
        - ZM
        - ZW
    MacOSFileExistenceMetadata:
      title: MacOSFileExistenceMetadata
      type: object
      properties:
        path:
          type: string
          description: Full path to the file on macOS
        teamIdentifier:
          type: string
          description: Apple Team Identifier to validate the file signature
      required:
        - path
    MacOSRunningProcessMetadata:
      title: MacOSRunningProcessMetadata
      type: object
      properties:
        name:
          type: string
          description: Process name or path on macOS
        teamIdentifier:
          type: string
          description: Apple Team Identifier to validate the process signature
      required:
        - name
    MacOSVersion:
      title: MacOSVersion
      type: object
      properties:
        enabled:
          type: boolean
        major:
          type: string
        minMinorVersion:
          type: string
      required:
        - enabled
        - major
    MacOSVersionAttribute:
      title: MacOSVersionAttribute
      type: object
      properties:
        any:
          type: boolean
          default: false
        versions:
          type: array
          items:
            $ref: '#/components/schemas/MacOSVersion'
    MaliciousFileProtectionControl:
      title: MaliciousFileProtectionControl
      type: object
      description: Prevent or detect download or upload of malicious files via Prisma Browser.
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          enum:
            - enable
            - disable
        detectionAction:
          type: string
          enum:
            - prevent
            - detectOnly
        provider:
          type: string
          enum:
            - crowdStrikeQuickScan
            - savapiScan
            - opswatMetaDefenderCore
            - yazamtech
            - votiro
            - advancedWildFire
        scanConfigurationId:
          type: string
        scanDownloads:
          type: boolean
        scanUploads:
          type: boolean
        blockOnScanError:
          type: boolean
        blockOversizedFiles:
          type: boolean
        blockUnsupportedFileTypes:
          type: boolean
        customDialogText:
          $ref: '#/components/schemas/CustomDialogText'
    ManagedShortcutsControl:
      title: ManagedShortcutsControl
      type: object
      nullable: true
      description: |
        Set the applications that appear on the new tab page and in bookmarks.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether managed shortcuts are configured
          enum:
            - setShortcuts
            - noShortcuts
        shortcuts:
          type: array
          description: |
            Managed shortcuts shown on the new tab page and in bookmarks.
            At most 16 entries may have `pinned: true`; requests that exceed this cap are rejected with HTTP 400.
          minItems: 1
          maxItems: 200
          items:
            type: object
            additionalProperties: false
            required:
              - name
              - url
            properties:
              name:
                type: string
                description: Shortcut display name
                minLength: 1
                maxLength: 256
                pattern: \S
              url:
                type: string
                description: Shortcut destination URL
                minLength: 1
                maxLength: 2048
              shortcutIconId:
                type: string
                description: Shortcut icon asset identifier
                maxLength: 100
              pinned:
                type: boolean
                description: Whether the shortcut is pinned
    ManagementSystemType:
      title: ManagementSystemType
      type: string
      description: Device management system type
      enum:
        - Microsoft Intune
        - Jamf
        - Active Directory
        - Azure AD
    MaxDevicesExceededError:
      description: The request exceeds the maximum number of devices allowed.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - MAX_DEVICES_EXCEEDED
              description: Discriminator - always "MAX_DEVICES_EXCEEDED".
    MetadataConfigurationVersion:
      title: MetadataConfigurationVersion
      type: object
      nullable: true
      description: Configuration version information
      required:
        - id
        - status
        - number
      properties:
        id:
          allOf:
            - $ref: '#/components/schemas/Pulid'
          description: Configuration version identifier
        status:
          type: string
          enum:
            - active
            - inactive
            - draft
          description: Configuration version status
        number:
          type: integer
          format: int32
          description: Configuration version number
    MfaRequired:
      title: MfaRequired
      type: boolean
      description: Whether the user must complete an MFA challenge before the control's restricted action is allowed. The MFA method (pinCode / identityProvider) is configured globally on the Browser Security Authentication Factor control and is not set per-rule.
      default: false
    Microsoft365TenantCondition:
      title: Microsoft365TenantCondition
      type: object
      properties:
        domains:
          type: array
          uniqueItems: true
          items:
            type: string
            pattern: ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$
            maxLength: 2048
            description: Valid domain name (e.g., contoso.com, contoso.onmicrosoft.com)
          minItems: 1
          maxItems: 100
          description: List of allowed Microsoft 365 domains
        resourceHosts:
          type: array
          uniqueItems: true
          items:
            type: string
            minLength: 1
            pattern: \S
            maxLength: 2048
            description: Valid resource host name (e.g., resource.contoso.com)
          minItems: 1
          maxItems: 100
          description: List of allowed Microsoft 365 resource hosts
      required:
        - domains
      additionalProperties: false
    MicrosoftProperties:
      title: MicrosoftProperties
      type: object
      nullable: true
      description: Microsoft OneDrive specific properties. Present only when type is microsoft.
      required:
        - tenantId
        - clientId
      properties:
        tenantId:
          type: string
          description: Azure AD tenant ID.
        clientId:
          type: string
          description: Azure AD application (client) ID.
    MobileDeviceManagementSystem:
      title: MobileDeviceManagementSystem
      type: object
      properties:
        name:
          type: string
          enum:
            - Jamf
            - Microsoft Intune
            - Other
        configurationValue:
          type: string
      required:
        - name
    MobileDeviceType:
      title: MobileDeviceType
      type: string
      description: Mobile device type
      enum:
        - smartphone
        - tablet
        - chromebook
    MobileManufacturer:
      title: MobileManufacturer
      type: string
      description: Mobile device manufacturer
      enum:
        - Asus
        - Coolpad
        - Google
        - HTC
        - Huawei
        - Infinix
        - Lenovo
        - LG
        - Meizu
        - Motorola
        - Nokia
        - OnePlus
        - Oppo
        - Realme
        - Samsung
        - Sony
        - TCL
        - Vivo
        - Xiaomi
        - ZTE
    MobileOs:
      title: MobileOs
      type: object
      properties:
        enabled:
          type: boolean
        version:
          type: string
        minSecurityPatch:
          type: string
        latest:
          type: boolean
      required:
        - enabled
        - version
    MobileOsVersion:
      title: MobileOsVersion
      type: object
      properties:
        any:
          type: boolean
        os:
          type: array
          items:
            $ref: '#/components/schemas/MobileOs'
      required:
        - any
        - os
    NativeMessagingHostsControl:
      title: NativeMessagingHostsControl
      type: object
      nullable: true
      description: Control which native messaging hosts can communicate with Prisma Browser and its extensions.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Native Messaging Hosts action.
          enum:
            - allow
            - allowAdminInstalledOnly
            - block
    NewTabPageControl:
      title: NewTabPageControl
      type: object
      nullable: true
      description: Set the type of page when a new Prisma Browser or tab is opened.
      additionalProperties: false
      required:
        - pageType
      properties:
        pageType:
          type: string
          description: New tab page type.
          enum:
            - default
            - customUrl
        customUrl:
          description: Custom new tab page URL. An http(s) URL or a schemeless host.
          allOf:
            - $ref: '#/components/schemas/WebUrl'
    NonWebAccessMode:
      title: NonWebAccessMode
      type: string
      enum:
        - none
        - anyAdminDefined
        - specific
      description: Whether this rule applies to no non-web apps, any admin-defined non-web app, or specific non-web apps
    NonWebApplication:
      title: NonWebApplication
      description: |
        Non-Web Application. For this type, `urls` is not an administrator-supplied URL pattern: it holds a single URL that the service generates from the application ID and protocol, which opens the remote connection page in the browser. Use `address`, `protocol` and `port` to identify the target host.
      type: object
      allOf:
        - $ref: '#/components/schemas/BaseApplicationWithUrls'
        - type: object
          properties:
            address:
              type: string
              description: Host name or IP address of the target host.
            protocol:
              type: string
            port:
              type: string
            routeToPrisma:
              type: boolean
            type:
              type: string
              description: Discriminator field, must be 'non-web'.
              enum:
                - non-web
    NonWebApplicationInput:
      title: NonWebApplicationInput
      allOf:
        - $ref: '#/components/schemas/BaseApplicationInput'
        - type: object
          properties:
            type:
              $ref: '#/components/schemas/NonwebTypeInput'
            address:
              type: string
            protocol:
              type: string
            port:
              type: string
            routeToPrisma:
              type: boolean
          required:
            - protocol
            - port
            - address
    NonWebPatchApplicationInput:
      title: NonWebPatchApplicationInput
      allOf:
        - $ref: '#/components/schemas/BasePatchApplicationInput'
        - type: object
          properties:
            type:
              $ref: '#/components/schemas/NonwebTypeInput'
            address:
              type: string
            protocol:
              type: string
            port:
              type: string
            routeToPrisma:
              type: boolean
          required:
            - type
    NonwebTypeInput:
      title: NonwebTypeInput
      type: string
      description: Discriminator field, must be 'non-web'.
      enum:
        - non-web
    NotFoundError:
      title: NotFoundError
      description: The requested resource was not found.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - NOT_FOUND
              description: Discriminator - always "NOT_FOUND".
      example:
        code: NOT_FOUND
        message: The requested resource was not found.
        timestamp: '2026-01-01T00:00:00Z'
    NotFoundResponse:
      title: NotFoundResponse
      description: Error envelope returned for 404 Not Found responses.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/NotFoundError'
    NotImplementedError:
      description: The requested capability is not implemented or enabled.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - NOT_IMPLEMENTED
              description: Discriminator - always "NOT_IMPLEMENTED".
    NotImplementedResponse:
      description: Error envelope returned for 501 Not Implemented responses.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/NotImplementedError'
    NotificationsControl:
      title: NotificationsControl
      type: object
      nullable: true
      description: Control the ability to display notifications in the browser.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to allow or block Notifications.
          enum:
            - allow
            - block
        excludedDomains:
          type: array
          description: Domains excluded from the chosen action.
          maxItems: 1000
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Domain'
    NullablePulid:
      title: NullablePulid
      type: string
      nullable: true
      minLength: 29
      maxLength: 29
      pattern: ^0[A-Z]{2}[0-9A-Z]{26}$
      description: A nullable identifier in PULID format (29 characters). Null or omitted means unset.
      example: 0AB06GY5P54Q1QN4MKR4AS8GAVRK9
    OnBrowserStartupControl:
      title: OnBrowserStartupControl
      type: object
      nullable: true
      description: Control the browser's 'On Startup' settings
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Browser startup behavior
          enum:
            - configuredByUser
            - restorePreviousSession
            - restorePreviousSessionAndOpenUrls
            - openNewTabPage
            - openUrls
        urlsToOpen:
          type: array
          uniqueItems: true
          description: URLs opened on startup or after restoring the previous session. Required and must be non-empty when action is openUrls or restorePreviousSessionAndOpenUrls; must not be set for other actions. Each entry must be an http(s)/ftp URL, a schemeless host (e.g. example.com), a browser page (chrome:// or prisma://), or a file:// URL. Dangerous schemes (javascript:, data:, vbscript:) and other custom schemes are rejected.
          items:
            type: string
            minLength: 1
            maxLength: 2048
            pattern: ^(?:(?:[Hh][Tt][Tt][Pp][Ss]?|[Ff][Tt][Pp]|[Cc][Hh][Rr][Oo][Mm][Ee]|[Pp][Rr][Ii][Ss][Mm][Aa]|[Ff][Ii][Ll][Ee])://|[^\s:/?#]+\.[^\s:/?#]+)
          maxItems: 50
        recommended:
          type: boolean
          description: Whether this setting is recommended and user-changeable.
    OnboardingWizardControl:
      title: OnboardingWizardControl
      type: object
      nullable: true
      description: Configure the end-user onboarding wizard.
      additionalProperties: false
      required:
        - enabled
      properties:
        enabled:
          type: boolean
          description: Whether the onboarding wizard is enabled.
        steps:
          type: object
          description: Onboarding wizard steps shown to end users. Required when enabled is true. Must not be set when enabled is false.
          additionalProperties: false
          required:
            - welcome
            - customize
            - import
            - policy
            - extension
            - restriction
            - mobile
            - passwordManager
          properties:
            welcome:
              type: object
              description: Welcome step configuration.
              additionalProperties: false
              required:
                - enabled
              properties:
                enabled:
                  type: boolean
                  description: Whether the Welcome step is enabled.
                title:
                  type: string
                  description: Custom title for the Welcome step.
                  minLength: 1
                  maxLength: 160
                  pattern: \S
                description:
                  type: string
                  description: Custom description for the Welcome step.
                  minLength: 1
                  maxLength: 320
                  pattern: \S
                link:
                  type: object
                  description: Optional Welcome step link.
                  additionalProperties: false
                  required:
                    - label
                    - url
                  properties:
                    label:
                      type: string
                      description: Link label.
                      minLength: 1
                      maxLength: 30
                      pattern: \S
                    url:
                      description: Link URL. An http(s) URL or a schemeless host.
                      allOf:
                        - $ref: '#/components/schemas/WebUrl'
            customize:
              type: object
              description: Customize step configuration.
              additionalProperties: false
              required:
                - enabled
              properties:
                enabled:
                  type: boolean
                  description: Whether the Customize step is enabled.
            import:
              type: object
              description: Import step configuration.
              additionalProperties: false
              required:
                - enabled
              properties:
                enabled:
                  type: boolean
                  description: Whether the Import step is enabled.
            policy:
              type: object
              description: Labels & Policy indicator step configuration.
              additionalProperties: false
              required:
                - enabled
              properties:
                enabled:
                  type: boolean
                  description: Whether the Labels & Policy indicator step is enabled.
            extension:
              type: object
              description: Popup extensions & Notifications step configuration.
              additionalProperties: false
              required:
                - enabled
              properties:
                enabled:
                  type: boolean
                  description: Whether the Popup extensions & Notifications step is enabled.
            restriction:
              type: object
              description: Restrictions step configuration.
              additionalProperties: false
              required:
                - enabled
              properties:
                enabled:
                  type: boolean
                  description: Whether the Restrictions step is enabled.
            mobile:
              type: object
              description: Mobile & Sync step configuration.
              additionalProperties: false
              required:
                - enabled
              properties:
                enabled:
                  type: boolean
                  description: Whether the Mobile & Sync step is enabled.
            passwordManager:
              type: object
              description: Password Manager step configuration.
              additionalProperties: false
              required:
                - enabled
              properties:
                enabled:
                  type: boolean
                  description: Whether the Password Manager step is enabled.
    OpenAITenantCondition:
      title: OpenAITenantCondition
      type: object
      properties:
        accountIds:
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 100
          minItems: 1
          maxItems: 100
          description: List of allowed OpenAI account IDs
        domains:
          type: array
          uniqueItems: true
          items:
            type: string
            pattern: ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$
            maxLength: 2048
            description: Valid domain name (e.g., example.com, sub.example.com)
          minItems: 1
          maxItems: 100
          description: List of allowed OpenAI domains
      minProperties: 1
      additionalProperties: false
    OpenInPrismaBrowser:
      title: OpenInPrismaBrowser
      description: Configuration for the Extension to Prisma Browser handoff.
      type: object
      required:
        - redirectToPrismaBrowser
      additionalProperties: false
      properties:
        redirectToPrismaBrowser:
          type: boolean
          description: Enforce the Extension to Prisma Browser redirect for matched traffic.
        autoRedirectToPrismaBrowser:
          type: boolean
          description: When true, redirection happens automatically without an interstitial dialog. Only valid when redirectToPrismaBrowser is true.
          default: false
        customDialogText:
          description: Custom text for the 'Open in Prisma Browser' interstitial dialog.
          $ref: '#/components/schemas/CustomDialogText'
    OpenLinksInExternalAppsControl:
      title: OpenLinksInExternalAppsControl
      type: object
      nullable: true
      description: Control the ability of other apps to open links from Prisma Browser.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Open Links in External Apps action.
          enum:
            - alwaysAllow
            - allowSpecificApps
            - alwaysBlock
            - askUser
        allowedApps:
          type: array
          description: Applications allowed to open links from the browser when action is 'allowSpecificApps'.
          maxItems: 10
          uniqueItems: true
          items:
            type: string
            enum:
              - gmail
              - googleDocs
              - googleDrive
              - microsoft365
              - microsoftOneDrive
              - microsoftOutlook
              - microsoftTeams
              - salesforce
              - slack
              - zoom
    Order:
      title: Order
      type: string
      description: The sort order
      enum:
        - asc
        - desc
    OsPasswordComplexity:
      title: OsPasswordComplexity
      type: object
      properties:
        enabled:
          type: boolean
      required:
        - enabled
    OverrideDurationMinutes:
      title: OverrideDurationMinutes
      type: string
      description: 'Duration in minutes for a timeframe window (e.g. user-prompt bypass window or authentication session validity). Must be sent as a string; integer values are rejected with a 400. Allowed values: 0 (single use / every time), 10 (10m), 60 (1h), 240 (4h), 540 (9h), 720 (12h), 1440 (24h), 4320 (3d), 10080 (7d), 20160 (14d), 43200 (30d), 86400 (60d), 129600 (90d).'
      enum:
        - '0'
        - '10'
        - '60'
        - '240'
        - '540'
        - '720'
        - '1440'
        - '4320'
        - '10080'
        - '20160'
        - '43200'
        - '86400'
        - '129600'
    PacFileUploadResponse:
      title: PacFileUploadResponse
      type: object
      required:
        - pacFileId
      properties:
        pacFileId:
          type: string
          description: PAC file asset identifier. Pass this value as-is to the `proxyAutoConfigurationPacFile` control's `pacFileId` field.
    PageInfo:
      title: PageInfo
      type: object
      properties:
        hasNextPage:
          type: boolean
          description: When paginating forwards, are there more items?
        cursor:
          type: string
          nullable: true
          description: When paginating forwards, the cursor to continue.
        totalCount:
          type: integer
          format: int32
          minimum: 0
          description: Total number of items across all pages. Populated on the first page by default; set includeTotalCount to override.
      required:
        - hasNextPage
    PageTranslationGoogleTranslateControl:
      title: PageTranslationGoogleTranslateControl
      type: object
      nullable: true
      description: Control the Google Translation banner on foreign-language pages.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: How the Google Translation banner is offered.
          enum:
            - alwaysOfferTranslation
            - neverOfferTranslation
            - allowUserChoice
    PagesWithInsecureContentControl:
      title: PagesWithInsecureContentControl
      type: object
      nullable: true
      description: Set whether pages with insecure content are available.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to allow or block Pages with Insecure Content.
          enum:
            - allow
            - block
        excludedDomains:
          type: array
          description: Domains excluded from the chosen action.
          maxItems: 1000
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Domain'
    PasskeyLoginControl:
      title: PasskeyLoginControl
      type: object
      nullable: true
      additionalProperties: false
      description: Control logging in to applications with a passkey.
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to allow or block passkey-based logins.
          enum:
            - allow
            - block
        mfaRequired:
          type: boolean
          description: Whether the user must complete an MFA challenge before passkey login is allowed.
        userPrompt:
          description: 'How the user is prompted before the passkey login restriction is applied. durationMinutes is accepted for every mode except none: it sets how long the user''s own bypass lasts as well as how long an admin approval stays valid. Supported values run from ''10'' (10 minutes) to ''129600'' (90 days), matching the dashboard; ''0'' is rejected.'
          $ref: '#/components/schemas/UserPrompt'
        customDialogText:
          $ref: '#/components/schemas/CustomDialogText'
    PatchAppGroupInput:
      title: PatchAppGroupInput
      type: object
      properties:
        name:
          type: string
          description: Name of the application group
        description:
          type: string
          description: Description of the application group
        applications:
          oneOf:
            - $ref: '#/components/schemas/AddRemoveApps'
            - $ref: '#/components/schemas/ReplaceApps'
    PatchAppInput:
      title: PatchAppInput
      oneOf:
        - $ref: '#/components/schemas/CustomPatchApplicationInput'
        - $ref: '#/components/schemas/PrivatePatchApplicationInput'
        - $ref: '#/components/schemas/NonWebPatchApplicationInput'
        - $ref: '#/components/schemas/LocalDesktopPatchApplicationInput'
      discriminator:
        propertyName: type
        mapping:
          custom: '#/components/schemas/CustomPatchApplicationInput'
          private: '#/components/schemas/PrivatePatchApplicationInput'
          non-web: '#/components/schemas/NonWebPatchApplicationInput'
          localdesktopcustom: '#/components/schemas/LocalDesktopPatchApplicationInput'
    PatchCidrs:
      title: PatchCidrs
      oneOf:
        - $ref: '#/components/schemas/CidrsInput'
        - $ref: '#/components/schemas/AddRemoveCidrs'
    PatchPositionsRequest:
      title: PatchPositionsRequest
      description: Request body for PATCH positions — an ordered list of moves to apply atomically.
      type: object
      required:
        - moves
      properties:
        moves:
          type: array
          minItems: 1
          maxItems: 100
          description: |
            Ordered list of moves to apply. Each move repositions one rule or section into an explicit container (target.sectionId) using a position keyword plus an optional anchor. Section subjects auto-carry their child rules. Default (baseline) rules are pinned at the bottom and cannot be moved or anchored on. All moves apply atomically — if any move fails, no DB changes or audit events are produced. The failing move's index is in the error details.
          items:
            $ref: '#/components/schemas/PositionMove'
      additionalProperties: false
      example:
        moves:
          - subject:
              type: Rule
              id: 0RU00000000000000000000000001
            target:
              position: after
              anchor:
                type: Section
                id: 0RS00000000000000000000000001
              sectionId: null
          - subject:
              type: Section
              id: 0RS00000000000000000000000002
            target:
              position: top
    PatchScope:
      title: PatchScope
      type: object
      additionalProperties: false
      minProperties: 1
      description: Provide scope to describe this rule
      properties:
        users:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The users or user groups the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any users or user groups are included in the scope. If isAny is set to true, no other fields should be present, and all users and user groups will be included in the scope. If isAny is set to false, the final scope must contain at least one user or user group.
            users:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: Full list of users for replacement.
            addUsers:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: List of users to add to the current scope.
            removeUsers:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: List of users to remove from the current scope.
            userGroups:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: Full list of user groups for replacement.
            addUserGroups:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: List of user groups to add to the current scope.
            removeUserGroups:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: List of user groups to remove from the current scope.
        deviceGroups:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The device groups the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any device groups are included in the scope. If isAny is set to true, no other fields should be present, and all device groups will be included in the scope. If isAny is set to false, the final scope must contain at least one device group.
            deviceGroups:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: Full list of device groups for replacement.
            addDeviceGroups:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: List of device groups to add to the current scope.
            removeDeviceGroups:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: List of device groups to remove from the current scope.
        publicIps:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The public IP addresses the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any public IP addresses are included in the scope. If isAny is set to true, no other fields should be present, and all public IP addresses will be included in the scope. If isAny is set to false, the final scope must contain at least one public IP.
            publicIps:
              allOf:
                - $ref: '#/components/schemas/IPArray'
                - description: Full list of public IP addresses for replacement.
                - example:
                    - 8.8.8.8/32
                    - 1.1.1.1/16
                    - 2.2.2.2
            addPublicIps:
              allOf:
                - $ref: '#/components/schemas/IPArray'
                - description: List of public IP addresses to add to the current scope.
                - example:
                    - 8.8.8.8/32
                    - 1.1.1.1/16
                    - 2.2.2.2
            removePublicIps:
              allOf:
                - $ref: '#/components/schemas/IPArray'
                - description: List of public IP addresses to remove from the current scope.
                - example:
                    - 8.8.8.8/32
                    - 1.1.1.1/16
                    - 2.2.2.2
        privateIps:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The private IP addresses the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any private IP addresses are included in the scope. If isAny is set to true, no other fields should be present, and all private IP addresses will be included in the scope. If isAny is set to false, the final scope must contain at least one private IP.
            privateIps:
              allOf:
                - $ref: '#/components/schemas/IPArray'
                - description: Full list of private IP addresses for replacement.
                - example:
                    - 192.168.1.1/32
                    - 192.168.1.8/16
                    - 10.0.0.1/32
            addPrivateIps:
              allOf:
                - $ref: '#/components/schemas/IPArray'
                - description: List of private IP addresses to add to the current scope.
                - example:
                    - 192.168.1.1/32
                    - 192.168.1.8/16
                    - 10.0.0.1/32
            removePrivateIps:
              allOf:
                - $ref: '#/components/schemas/IPArray'
                - description: List of private IP addresses to remove from the current scope.
                - example:
                    - 192.168.1.1/32
                    - 192.168.1.8/16
                    - 10.0.0.1/32
        locations:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The locations the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any locations are included in the scope. If isAny is set to true, no other fields should be present, and all locations will be included in the scope. If isAny is set to false, the final scope must contain at least one location.
            locations:
              allOf:
                - $ref: '#/components/schemas/CountryCodeArray'
                - description: Full list of locations for replacement.
                - example:
                    - US
                    - GB
                    - FR
            addLocations:
              allOf:
                - $ref: '#/components/schemas/CountryCodeArray'
                - description: List of locations to add to the current scope.
                - example:
                    - US
                    - GB
                    - FR
            removeLocations:
              allOf:
                - $ref: '#/components/schemas/CountryCodeArray'
                - description: List of locations to remove from the current scope.
                - example:
                    - US
                    - GB
                    - FR
    PatchTagIDs:
      oneOf:
        - $ref: '#/components/schemas/TagIDsInput'
        - $ref: '#/components/schemas/AddRemoveTagIDs'
    PatchUrls:
      title: PatchUrls
      oneOf:
        - $ref: '#/components/schemas/UrlsInput'
        - $ref: '#/components/schemas/AddRemoveUrls'
    PendingChange:
      title: PendingChange
      type: object
      description: A single entity that has changed in the draft relative to the active version.
      required:
        - entityId
        - entityType
        - operation
        - name
        - lastUpdatedBy
      properties:
        entityId:
          allOf:
            - $ref: '#/components/schemas/Pulid'
          description: Unique ID of the changed entity.
        entityType:
          $ref: '#/components/schemas/DraftEntityTypes'
        name:
          type: string
          description: The name of the entity. For a deleted entity, the name it had before deletion.
        operation:
          type: string
          enum:
            - created
            - updated
            - deleted
          description: What changed in the draft relative to the active version.
        lastUpdatedBy:
          type: string
          description: Who last modified this entity in the draft. For an interactive admin, their email; for an API/automation caller, the service-account identifier. Empty when the updater is no longer available (e.g. the user was deleted).
    Plugin:
      title: Plugin
      type: object
      properties:
        events:
          type: array
          items:
            $ref: '#/components/schemas/PluginEvent'
        links:
          type: array
          items:
            $ref: '#/components/schemas/PluginLink'
        elements:
          type: array
          items:
            $ref: '#/components/schemas/PluginElement'
    PluginElement:
      title: PluginElement
      type: object
      properties:
        elementType:
          type: string
          enum:
            - excludeAccountShield
            - includeAccountShield
        urlPattern:
          type: string
        selectors:
          type: array
          items:
            type: string
      required:
        - elementType
        - selectors
    PluginEvent:
      title: PluginEvent
      type: object
      properties:
        eventType:
          type: string
          enum:
            - loginFail
            - loginAttempt
            - passwordReset
            - userRegistration
        requestUrl:
          type: string
        triggerUrl:
          type: string
        triggerOnSuccess:
          type: boolean
        triggerOnFail:
          type: boolean
        method:
          type: string
          enum:
            - GET
            - POST
            - PUT
            - PATCH
            - DELETE
        statusCode:
          type: integer
        minContentLength:
          type: integer
        maxContentLength:
          type: integer
        headers:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
              content:
                type: string
            required:
              - name
              - content
      required:
        - eventType
    PluginLink:
      title: PluginLink
      type: object
      properties:
        urlPattern:
          type: string
        resetPasswordUrl:
          type: string
        loginPageUrl:
          type: string
    PluginResponse:
      title: PluginResponse
      type: object
      properties:
        id:
          type: string
          description: Unique identifier
        createTime:
          readOnly: true
          type: string
          format: date-time
          description: Creation time of the plugin
        updateTime:
          readOnly: true
          type: string
          format: date-time
          description: Last update time of the plugin
        plugin:
          $ref: '#/components/schemas/Plugin'
        applicationId:
          type: string
          description: Application ID of the application the plugin is associated to
      required:
        - id
        - createTime
        - updateTime
        - plugin
        - applicationId
    PolicyBadRequestResponse:
      title: PolicyBadRequestResponse
      description: Error envelope returned for 400 Bad Request from policy mutation endpoints (rule/section create, update, and positioning). The `error.code` discriminates which structured `details` (if any) are present.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          oneOf:
            - $ref: '#/components/schemas/ValidationError'
            - $ref: '#/components/schemas/FieldValidationError'
            - $ref: '#/components/schemas/ContiguityViolationError'
            - $ref: '#/components/schemas/IncompleteArrayError'
          discriminator:
            propertyName: code
            mapping:
              VALIDATION_ERROR: '#/components/schemas/ValidationError'
              FIELD_VALIDATION_ERROR: '#/components/schemas/FieldValidationError'
              CONTIGUITY_VIOLATION: '#/components/schemas/ContiguityViolationError'
              INCOMPLETE_ARRAY: '#/components/schemas/IncompleteArrayError'
    PolicyItem:
      title: PolicyItem
      description: Represents a single item in the policy, which can be either a Rule or a Section.
      oneOf:
        - $ref: '#/components/schemas/RuleSummary'
        - $ref: '#/components/schemas/Section'
      discriminator:
        propertyName: type
        mapping:
          Rule: '#/components/schemas/RuleSummary'
          Section: '#/components/schemas/Section'
    PolicyNotFoundResponse:
      title: PolicyNotFoundResponse
      description: Error envelope returned for 404 Not Found from policy mutation endpoints (rule/section update and positioning). The `error.code` discriminates which structured `details` (if any) are present.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          oneOf:
            - $ref: '#/components/schemas/NotFoundError'
            - $ref: '#/components/schemas/FieldReferenceNotFoundError'
          discriminator:
            propertyName: code
            mapping:
              NOT_FOUND: '#/components/schemas/NotFoundError'
              FIELD_REFERENCE_NOT_FOUND: '#/components/schemas/FieldReferenceNotFoundError'
    PolicyPositioning:
      title: PolicyPositioning
      type: object
      description: Optional placement directive for the entity. On create, when omitted, the entity is placed at the top of the stack. On update, when omitted, the entity's current position is preserved.
      required:
        - target
      properties:
        target:
          type: object
          required:
            - position
          properties:
            position:
              type: string
              description: 'Where to place the entity: top (first), bottom (last), before (above anchor), after (below anchor). The before and after values require the anchor field. The top and bottom values must not include an anchor field — providing an anchor with top or bottom is a validation error.'
              enum:
                - top
                - bottom
                - before
                - after
            anchor:
              type: object
              required:
                - type
                - id
              properties:
                type:
                  type: string
                  enum:
                    - Rule
                    - Section
                id:
                  allOf:
                    - $ref: '#/components/schemas/Pulid'
                  description: The entity ID of the anchor item.
              additionalProperties: false
            sectionId:
              allOf:
                - $ref: '#/components/schemas/NullablePulid'
              description: The section the rule should belong to. Only valid for rule POST and PATCH; must be null/omitted for section POST and PATCH (sections cannot be nested). The anchor (if any) must reside in this same container.
          additionalProperties: false
      additionalProperties: false
    PopupsControl:
      title: PopupsControl
      type: object
      nullable: true
      description: Control the ability to display popups in the browser.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to allow or block Popups.
          enum:
            - allow
            - block
        excludedDomains:
          type: array
          description: Domains excluded from the chosen action.
          maxItems: 1000
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Domain'
    PositionItem:
      title: PositionItem
      description: A section or rule in the desired position order
      oneOf:
        - $ref: '#/components/schemas/PositionItemSection'
        - $ref: '#/components/schemas/PositionItemRule'
      discriminator:
        propertyName: type
        mapping:
          Section: '#/components/schemas/PositionItemSection'
          Rule: '#/components/schemas/PositionItemRule'
    PositionItemRule:
      title: PositionItemRule
      description: A rule in the desired position order
      type: object
      required:
        - type
        - id
      properties:
        type:
          type: string
          enum:
            - Rule
          description: Discriminator — must be "Rule"
        id:
          allOf:
            - $ref: '#/components/schemas/Pulid'
          description: The rule ID
        sectionId:
          allOf:
            - $ref: '#/components/schemas/NullablePulid'
          description: The section this rule belongs to (null or omitted = standalone)
      additionalProperties: false
    PositionItemSection:
      title: PositionItemSection
      description: A section in the desired position order
      type: object
      required:
        - type
        - id
      properties:
        type:
          type: string
          enum:
            - Section
          description: Discriminator — must be "Section"
        id:
          allOf:
            - $ref: '#/components/schemas/Pulid'
          description: The section ID
      additionalProperties: false
    PositionMove:
      title: PositionMove
      description: A single move operation — repositions one rule or section within the policy.
      type: object
      required:
        - subject
        - target
      properties:
        subject:
          $ref: '#/components/schemas/PositionMoveSubject'
        target:
          $ref: '#/components/schemas/PositionMoveTarget'
      additionalProperties: false
    PositionMoveSubject:
      title: PositionMoveSubject
      description: The entity to be moved (rule or section).
      type: object
      required:
        - type
        - id
      properties:
        type:
          type: string
          enum:
            - Rule
            - Section
          description: Whether the entity being moved is a rule or a section.
        id:
          allOf:
            - $ref: '#/components/schemas/Pulid'
          description: The entity ID of the subject. In draft mode this is the EntityID; otherwise it is the row ID. Must match the actual entity type specified in 'type'.
      additionalProperties: false
    PositionMoveTarget:
      title: PositionMoveTarget
      description: |
        The destination for the move. 'position' and 'anchor' describe placement within the container indicated by 'sectionId'. Anchoring on a Section is only valid at top level (sectionId null/omitted) and refers to the whole section block.
      type: object
      required:
        - position
      properties:
        position:
          type: string
          enum:
            - top
            - bottom
            - before
            - after
          description: |
            Where to place the subject within its container. 'top'/'bottom': first/last within the container (no anchor allowed). 'before'/'after': immediately before/after the anchor sibling (anchor required).
        anchor:
          type: object
          description: |
            Reference sibling within the same container. Required when position is 'before' or 'after'. Forbidden for 'top' or 'bottom'. The anchor must reside in the container indicated by sectionId (or at top level when sectionId is null). Default (baseline) rules cannot be used as anchors.
          required:
            - type
            - id
          properties:
            type:
              type: string
              enum:
                - Rule
                - Section
              description: Whether the anchor is a rule or a section. Section anchors are only valid at top level.
            id:
              allOf:
                - $ref: '#/components/schemas/Pulid'
              description: The entity ID of the anchor item. Must match the actual entity type specified in 'type'.
          additionalProperties: false
        sectionId:
          allOf:
            - $ref: '#/components/schemas/NullablePulid'
          description: |
            The section the subject should belong to after the move. Null or omitted means top level. Only valid when subject.type is Rule. Must be null/omitted when subject.type is Section (sections cannot nest). The anchor (if any) must reside in this same container.
      additionalProperties: false
    PositionsSuccessResponse:
      title: PositionsSuccessResponse
      description: Successful position update response
      type: object
      required:
        - message
        - itemsUpdated
      properties:
        message:
          type: string
          description: Human-readable success message
        itemsUpdated:
          type: integer
          format: int32
          description: Number of items repositioned
      additionalProperties: false
    PostQuantumKeySecurityControl:
      title: PostQuantumKeySecurityControl
      type: object
      nullable: true
      description: Control whether to offer a post-quantum key agreement algorithm in TLS.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Post Quantum Key Security action.
          enum:
            - enable
            - disable
            - default
    PostScope:
      title: PostScope
      type: object
      additionalProperties: false
      minProperties: 1
      description: Provide scope to describe this rule
      properties:
        users:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The users or user groups the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any users or user groups are included in the scope. If isAny is set to true, no other fields should be present, and all users and user groups will be included in the scope. If isAny is set to false, the final scope must contain at least one user or user group.
            users:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: Full list of users for replacement.
            userGroups:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: Full list of user groups for replacement.
        deviceGroups:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The device groups the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any device groups are included in the scope. If isAny is set to true, no other fields should be present, and all device groups will be included in the scope. If isAny is set to false, the final scope must contain at least one device group.
            deviceGroups:
              allOf:
                - $ref: '#/components/schemas/PulidArray'
                - description: Full list of device groups for replacement.
        publicIps:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The public IP addresses the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any public IP addresses are included in the scope. If isAny is set to true, no other fields should be present, and all public IP addresses will be included in the scope. If isAny is set to false, the final scope must contain at least one public IP.
            publicIps:
              allOf:
                - $ref: '#/components/schemas/IPArray'
                - description: Full list of public IP addresses for replacement.
                - example:
                    - 8.8.8.8/32
                    - 1.1.1.1/16
                    - 2.2.2.2
        privateIps:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The private IP addresses the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any private IP addresses are included in the scope. If isAny is set to true, no other fields should be present, and all private IP addresses will be included in the scope. If isAny is set to false, the final scope must contain at least one private IP.
            privateIps:
              allOf:
                - $ref: '#/components/schemas/IPArray'
                - description: Full list of private IP addresses for replacement.
                - example:
                    - 192.168.1.1/32
                    - 192.168.1.8/16
                    - 10.0.0.1/32
        locations:
          type: object
          additionalProperties: false
          minProperties: 1
          description: The locations the rule applies to.
          properties:
            isAny:
              type: boolean
              nullable: true
              description: Flag indicating if any locations are included in the scope. If isAny is set to true, no other fields should be present, and all locations will be included in the scope. If isAny is set to false, the final scope must contain at least one location.
            locations:
              allOf:
                - $ref: '#/components/schemas/CountryCodeArray'
                - description: Full list of locations for replacement.
                - example:
                    - US
                    - GB
                    - FR
    PrintControl:
      title: PrintControl
      type: object
      description: Control printing of web pages and files opened in Prisma Browser.
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to allow or block printing of web pages and files opened in Prisma Browser.
          enum:
            - allow
            - block
        userPrompt:
          description: How the user is prompted before the print restriction is applied. Only valid when action is 'allow'.
          $ref: '#/components/schemas/UserPrompt'
        customDialogText:
          description: Custom text shown in the print prompt or block dialog.
          $ref: '#/components/schemas/CustomDialogText'
    PrismaBrowserLocalExtenderControl:
      title: PrismaBrowserLocalExtenderControl
      type: object
      nullable: true
      description: Control the use of Prisma Browser Local Extender (PABL).
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Prisma Browser Local Extender is activated.
          enum:
            - enable
            - disable
    PrivateApplication:
      title: PrivateApplication
      description: Private Application
      type: object
      allOf:
        - $ref: '#/components/schemas/BaseApplicationWithUrls'
        - type: object
          properties:
            primaryUrl:
              type: string
            routeToPrisma:
              type: boolean
            domainSuffix:
              type: string
              nullable: true
              description: |
                DNS suffix appended to single-label hostnames (for example, corp.example.com). Required when any URL or primary URL uses a short hostname.
            cidrs:
              type: array
              uniqueItems: true
              description: CIDR ranges for the private application. IPv4 only, /8 to /32.
              items:
                type: string
            type:
              type: string
              description: Discriminator field, must be 'private'.
              enum:
                - private
    PrivateApplicationInput:
      title: PrivateApplicationInput
      allOf:
        - $ref: '#/components/schemas/BaseApplicationInput'
        - type: object
          properties:
            urls:
              $ref: '#/components/schemas/UrlsInput'
            type:
              $ref: '#/components/schemas/PrivateTypeInput'
            primaryUrl:
              type: string
            routeToPrisma:
              type: boolean
            cidrs:
              type: array
              description: CIDR ranges for the private application. IPv4 only, /8 to /32.
              items:
                type: string
              maxItems: 100
            category:
              type: string
            domainSuffix:
              type: string
              nullable: true
              description: |
                DNS suffix appended to single-label hostnames (for example, corp.example.com). Required when any URL or primary URL uses a short hostname.
          required:
            - urls
            - primaryUrl
            - routeToPrisma
            - type
    PrivatePatchApplicationInput:
      title: PrivatePatchApplicationInput
      allOf:
        - $ref: '#/components/schemas/BasePatchApplicationInput'
        - type: object
          properties:
            urls:
              $ref: '#/components/schemas/PatchUrls'
            type:
              $ref: '#/components/schemas/PrivateTypeInput'
            primaryUrl:
              type: string
            routeToPrisma:
              type: boolean
            cidrs:
              $ref: '#/components/schemas/PatchCidrs'
            category:
              type: string
            domainSuffix:
              type: string
              nullable: true
              description: |
                DNS suffix appended to single-label hostnames (for example, corp.example.com). To update: set a string; use JSON null to clear; omit the property to leave unchanged.
          required:
            - type
    PrivateTypeInput:
      title: PrivateTypeInput
      type: string
      description: Discriminator field, must be 'private'.
      enum:
        - private
    ProfileSyncControl:
      title: ProfileSyncControl
      type: object
      nullable: true
      description: Set up user profile sync across all the devices a user is logged in to.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether profile sync is enabled.
          enum:
            - enabled
            - disabled
        syncMode:
          type: string
          description: Profile sync scope.
          enum:
            - syncEverything
            - customizeSync
        syncTypes:
          type: array
          description: Profile data types to sync.
          uniqueItems: true
          items:
            type: string
            enum:
              - apps
              - bookmarks
              - extensions
              - typedUrls
              - preferences
              - themes
              - tabs
              - savedTabGroups
              - readingList
              - autofill
              - passwords
    ProviderInUseError:
      title: ProviderInUseError
      description: The cloud storage provider is referenced by policy rules.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          required:
            - details
          properties:
            code:
              type: string
              enum:
                - PROVIDER_IN_USE
              description: Discriminator - always "PROVIDER_IN_USE".
            details:
              $ref: '#/components/schemas/ProviderInUseErrorDetails'
    ProviderInUseErrorDetails:
      title: ProviderInUseErrorDetails
      description: Structured context identifying policy rules that reference the provider.
      type: object
      required:
        - ruleIds
      additionalProperties: false
      properties:
        ruleIds:
          type: array
          description: IDs of rules referencing this provider.
          items:
            type: string
    ProxyAutoConfigurationPacFileControl:
      title: ProxyAutoConfigurationPacFileControl
      type: object
      nullable: true
      description: Configure Prisma Browser to use a proxy auto-configuration (PAC) file.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether to configure a PAC file.
          enum:
            - setPacFile
            - noPacFile
        pacFileId:
          type: string
          minLength: 1
          maxLength: 100
          description: PAC file asset identifier. Set `pacFileId` to the value returned by POST /assets/pac-file.
    PublishConflictResponse:
      description: 409 Conflict from the publish endpoint. `error.code` discriminates whether the draft has no pending changes to publish (CONFLICT) or another publish or draft reset already holds the draft lock, in which case nothing was published (PUBLISH_IN_PROGRESS).
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          oneOf:
            - $ref: '#/components/schemas/ConflictError'
            - $ref: '#/components/schemas/PublishInProgressError'
          discriminator:
            propertyName: code
            mapping:
              CONFLICT: '#/components/schemas/ConflictError'
              PUBLISH_IN_PROGRESS: '#/components/schemas/PublishInProgressError'
    PublishInProgressError:
      description: Another publish or draft-reset operation is already in progress for this tenant's draft, so this request applied no changes. A concurrent draft reset can discard the pending changes, so refresh the draft state before retrying.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - PUBLISH_IN_PROGRESS
              description: Discriminator - always "PUBLISH_IN_PROGRESS".
    Pulid:
      title: Pulid
      type: string
      description: A unique identifier in PULID format (29 characters).
      minLength: 29
      maxLength: 29
      pattern: ^0[A-Z]{2}[0-9A-Z]{26}$
      example: 0AB06GY5P54Q1QN4MKR4AS8GAVRK9
    PulidArray:
      title: PulidArray
      type: array
      uniqueItems: true
      description: A collection of up to 1000 unique Pulid strings.
      nullable: true
      maxItems: 1000
      items:
        $ref: '#/components/schemas/Pulid'
    RegKey:
      title: RegKey
      type: object
      properties:
        path:
          type: string
        values:
          type: array
          items:
            $ref: '#/components/schemas/RegValue'
      required:
        - path
    RegValue:
      title: RegValue
      type: object
      properties:
        name:
          type: string
        data:
          type: string
        type:
          $ref: '#/components/schemas/RegistryValueType'
      required:
        - name
    RegistryValueType:
      title: RegistryValueType
      type: string
      description: Registry value type
      enum:
        - String
        - Binary
        - DWORD
        - QWORD
        - MultiString
        - ExpandableString
    ReplaceApps:
      title: ReplaceApps
      type: array
      items:
        type: string
        pattern: ^0AP[0-9A-HJKMNP-TV-Z]{26}$
      maxItems: 2000
    ReplaceGoogleProviderRequest:
      title: ReplaceGoogleProviderRequest
      type: object
      description: Request body to replace a Google Drive provider (credential rotation).
      required:
        - emailAddress
        - serviceAccountKey
      properties:
        emailAddress:
          type: string
          description: Google Workspace admin email for domain-wide delegation.
          minLength: 1
        serviceAccountKey:
          type: string
          description: Base64-encoded Google service account JSON key.
          minLength: 1
    ReplaceMicrosoftProviderRequest:
      title: ReplaceMicrosoftProviderRequest
      type: object
      description: Request body to replace a Microsoft OneDrive provider (credential rotation).
      required:
        - tenantId
        - clientId
        - clientSecret
      properties:
        tenantId:
          type: string
          description: Azure AD tenant ID.
          minLength: 1
        clientId:
          type: string
          description: Azure AD application (client) ID.
          minLength: 1
        clientSecret:
          type: string
          description: Azure AD application client secret.
          minLength: 1
    RequestAction:
      type: object
      properties:
        action:
          type: string
          enum:
            - approve
            - decline
          description: Action to perform on the request
        adminComment:
          type: string
          format: string
          description: Admin comment on the action
        adminBypassTimeframe:
          type: string
          enum:
            - Once
            - 10m
            - 1h
            - 4h
            - 9h
            - 12h
            - 24h
            - 3d
            - 7d
            - 14d
            - 30d
            - 60d
            - 90d
          description: The timeframe for which the approval is valid
      required:
        - action
    RequestDesktopMobileSiteControl:
      title: RequestDesktopMobileSiteControl
      type: object
      nullable: true
      description: Override default site settings for specific domains on mobile devices.
      additionalProperties: false
      required:
        - rules
      properties:
        rules:
          type: array
          description: Desktop or mobile site overrides for selected domains.
          minItems: 1
          maxItems: 1000
          items:
            type: object
            additionalProperties: false
            required:
              - domain
              - mode
            properties:
              domain:
                type: string
                description: Match target the browser compares against visited URLs to apply the site-mode override. Accepts a hostname/domain (optionally with "*." or "*" wildcards, including a bare "*" catch-all for all sites), or a "scheme://host[:port]/path" match pattern. Must be non-empty and contain at least one letter, digit, or "*". Percent-encoding, fragments, and the path/query punctuation real match patterns use are admitted; whitespace and markup/injection characters that never appear in a host or match pattern are rejected.
                minLength: 1
                maxLength: 2048
                pattern: ^[A-Za-z0-9._:/*?=&%#~+@,;-]*[A-Za-z0-9*][A-Za-z0-9._:/*?=&%#~+@,;-]*$
              mode:
                type: string
                description: Requested site mode for the domain.
                enum:
                  - desktop
                  - mobile
    ResponseMetadata:
      title: ResponseMetadata
      type: object
      description: |
        Configuration metadata. Returned for configuration-versioned resources (applications, application groups, user groups, and policy endpoints). Not returned for users or devices, or for device groups (which accept the configurationVersion parameter but do not include this envelope in their responses).
      properties:
        configurationVersion:
          $ref: '#/components/schemas/MetadataConfigurationVersion'
    RestoreDevicesBadRequestResponse:
      description: Error envelope returned for 400 Bad Request from RestoreDevices. The error.code discriminates which validation failed.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          oneOf:
            - $ref: '#/components/schemas/InvalidDeviceIdError'
            - $ref: '#/components/schemas/UnexpectedDeviceStatusError'
          discriminator:
            propertyName: code
            mapping:
              INVALID_DEVICE_ID: '#/components/schemas/InvalidDeviceIdError'
              UNEXPECTED_DEVICE_STATUS: '#/components/schemas/UnexpectedDeviceStatusError'
    RestrictExtensionHostPermissionsControl:
      title: RestrictExtensionHostPermissionsControl
      type: object
      nullable: true
      description: Prevent extensions from running scripts and accessing content in websites.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to restrict extension host permissions on all domains, specific domains, or disable the restriction.
          enum:
            - enable
            - enableForSpecificDomains
            - disable
        includedDomains:
          type: array
          description: Domains where extension host permissions are restricted.
          maxItems: 1000
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Domain'
    RestrictedPolicyItem:
      title: RestrictedPolicyItem
      description: Represents a single item in the policy, which can be either a Rule or a Section. Used by rule types that do not support the 'monitor' mode.
      oneOf:
        - $ref: '#/components/schemas/RestrictedRuleSummary'
        - $ref: '#/components/schemas/Section'
      discriminator:
        propertyName: type
        mapping:
          Rule: '#/components/schemas/RestrictedRuleSummary'
          Section: '#/components/schemas/Section'
    RestrictedRuleMode:
      title: RestrictedRuleMode
      type: string
      description: The mode of the rule. The 'monitor' mode is not supported for this rule type.
      enum:
        - active
        - disabled
    RestrictedRuleSummary:
      title: RestrictedRuleSummary
      description: A summary of a specific rule.
      type: object
      allOf:
        - $ref: '#/components/schemas/BasePolicyItem'
        - type: object
          required:
            - type
            - mode
          properties:
            type:
              type: string
              description: Discriminator field, must be 'Rule'.
              enum:
                - Rule
            section:
              type: object
              nullable: true
              description: The section this rule belongs to. Null if it's a top-level rule.
              allOf:
                - $ref: '#/components/schemas/SectionRef'
            description:
              type: string
              description: The detailed description of the rule.
            mode:
              $ref: '#/components/schemas/RestrictedRuleMode'
            position:
              example: 1
            evaluationOrder:
              type: integer
              format: int32
              description: 1-based rank of this rule counting only rules (not sections). Defines the order in which rules are evaluated in the policy.
    ResumeDevicesBadRequestResponse:
      description: Error envelope returned for 400 Bad Request from ResumeDevices. The error.code discriminates which validation failed.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          oneOf:
            - $ref: '#/components/schemas/InvalidDeviceIdError'
            - $ref: '#/components/schemas/UnexpectedDeviceStatusError'
          discriminator:
            propertyName: code
            mapping:
              INVALID_DEVICE_ID: '#/components/schemas/InvalidDeviceIdError'
              UNEXPECTED_DEVICE_STATUS: '#/components/schemas/UnexpectedDeviceStatusError'
    RevokeRequestAction:
      type: object
      properties:
        revokerComment:
          type: string
          format: string
          description: Admin revoke comment
      required:
        - action
    RuleMode:
      title: RuleMode
      type: string
      description: The mode of the rule.
      enum:
        - active
        - disabled
        - monitor
    RuleSummary:
      title: RuleSummary
      description: A summary of a specific rule.
      type: object
      allOf:
        - $ref: '#/components/schemas/BasePolicyItem'
        - type: object
          required:
            - type
            - mode
          properties:
            type:
              type: string
              description: Discriminator field, must be 'Rule'.
              enum:
                - Rule
            section:
              type: object
              nullable: true
              description: The section this rule belongs to. Null if it's a top-level rule.
              allOf:
                - $ref: '#/components/schemas/SectionRef'
            description:
              type: string
              description: The detailed description of the rule.
            mode:
              $ref: '#/components/schemas/RuleMode'
            position:
              example: 1
            evaluationOrder:
              type: integer
              format: int32
              description: 1-based rank of this rule counting only rules (not sections). Defines the order in which rules are evaluated in the policy.
    SanitizingContentControl:
      title: SanitizingContentControl
      type: object
      description: Monitor and prevent sensitive data as it's typed into web applications, with inline protection when possible.
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Action for the sanitizing content control.
          enum:
            - enable
            - disable
        userPrompt:
          description: How the user is prompted when sensitive content is detected. Only valid when action is 'enable'.
          $ref: '#/components/schemas/UserPrompt'
        customDialogText:
          description: Custom text shown in the typing-guard prompt dialog. Only valid when action is 'enable'.
          $ref: '#/components/schemas/CustomDialogText'
    ScreenshotControl:
      title: ScreenshotControl
      type: object
      description: Control screen capture (using snipping tools or "print screen"), screen recording, and screen sharing using video conferencing tools.
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Screen-capture restriction. `allowSpecific` permits capture only via admin-selected mechanisms.
          enum:
            - allow
            - allowSpecific
            - block
        userPrompt:
          description: How the user is prompted when a screen capture is restricted. Only valid when action is allow.
          $ref: '#/components/schemas/UserPrompt'
        allowBrowserSnippingTool:
          type: boolean
          description: Whether the user can capture screenshots using Prisma Browser's built-in snipping tool. Only valid when action is allowSpecific. Defaults to false when omitted.
        allowSpecificScreenShareApps:
          type: boolean
          description: Whether the user can initiate screen sharing from a specified set of web apps. Only valid when action is allowSpecific. Defaults to false when omitted.
        allowedApplicationIds:
          type: array
          uniqueItems: true
          description: Application IDs permitted to initiate screen sharing. Required when allowSpecificScreenShareApps is true.
          maxItems: 100
          items:
            $ref: '#/components/schemas/Pulid'
    SearchEngineContentFilteringControl:
      title: SearchEngineContentFilteringControl
      type: object
      nullable: true
      description: Enable content filtering for search engines to reduce exposure to inappropriate or distracting material (e.g., adult or violent content). This setting is supported by selected search engines, as appears in the list below.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether search engine content filtering is enabled.
          enum:
            - enable
            - disable
        engines:
          type: array
          description: Search engines to enforce strict content filtering for. Required when action is "enable". Must not be set when action is "disable".
          minItems: 1
          maxItems: 10
          items:
            type: object
            additionalProperties: false
            required:
              - name
            properties:
              name:
                type: string
                description: Search engine name.
                enum:
                  - Google
                  - Bing
                  - DuckDuckGo
                  - YouTube
    SearchSuggestionsControl:
      title: SearchSuggestionsControl
      type: object
      nullable: true
      description: Show live search suggestions in the address bar as users type.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether live search suggestions are shown in the address bar.
          enum:
            - enable
            - disable
            - userChoice
    SearchUrl:
      title: SearchUrl
      type: string
      description: 'A default-search-provider URL template: an http(s) URL, or a Chrome built-in template beginning with the literal "{google:baseURL}" token (which the browser expands to a fixed https://www.google.<tld>/ origin). The {searchTerms} placeholder requirement and host validation are enforced server-side.'
      maxLength: 2000
      pattern: ^(?:https?://|\{google:baseURL\})
    Section:
      title: Section
      description: A container to group related rules for organizational purposes.
      type: object
      allOf:
        - $ref: '#/components/schemas/BasePolicyItem'
        - type: object
          required:
            - type
          properties:
            type:
              type: string
              description: Discriminator field, must be 'Section'.
              enum:
                - Section
            position:
              example: 2
    SectionDetailed:
      title: SectionDetailed
      description: A section object
      type: object
      required:
        - id
        - name
        - priority
        - metadata
      properties:
        id:
          allOf:
            - $ref: '#/components/schemas/Pulid'
          description: The unique identifier for the section
        name:
          type: string
          description: The name of the section.
          minLength: 1
          maxLength: 300
        priority:
          type: integer
          format: int32
          description: The ordinal priority of the section in the policy list.
          minimum: 1
        metadata:
          $ref: '#/components/schemas/metadata'
    SectionPatchRequest:
      title: SectionPatchRequest
      type: object
      minProperties: 1
      additionalProperties: false
      properties:
        name:
          type: string
          description: |
            The updated section name. Leading and trailing whitespace is trimmed before the value is stored. Names that are empty or consist entirely of whitespace are rejected with a 400 error.
          minLength: 1
          maxLength: 255
          pattern: \S
        positioning:
          $ref: '#/components/schemas/PolicyPositioning'
    SectionPostRequest:
      title: SectionPostRequest
      type: object
      required:
        - name
      additionalProperties: false
      properties:
        name:
          type: string
          description: The name of the section.
          minLength: 1
          maxLength: 255
          pattern: \S
        positioning:
          $ref: '#/components/schemas/PolicyPositioning'
    SectionRef:
      title: SectionRef
      type: object
      description: A reference to a policy section.
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: ID of the section
        name:
          type: string
          description: Name of the section
    SectionUpdateRequest:
      title: SectionUpdateRequest
      type: object
      required:
        - name
      properties:
        name:
          type: string
          description: |
            The updated section name. Leading and trailing whitespace is trimmed before the value is stored. Names that are empty or consist entirely of whitespace are rejected with a 400 error.
          minLength: 1
          maxLength: 255
          pattern: \S
      additionalProperties: false
    SecurityControls:
      title: SecurityControls
      type: object
      description: Controls for security rules.
      minProperties: 1
      additionalProperties: false
      properties:
        developerToolsForExtensions:
          description: Control DevTools to avoid inspection of browser extensions.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        cast:
          description: Control the ability to cast a tab or the whole desktop via Prisma Browser. Prisma Browser restart required to apply.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        cookiesProtection:
          description: Control the encryption of stored cookies on the device.
          allOf:
            - $ref: '#/components/schemas/EnableDisableControl'
        browserHistory:
          $ref: '#/components/schemas/BrowserHistoryControl'
        dnsOverHttps:
          $ref: '#/components/schemas/DnsOverHttpsControl'
        browserSelfProtection:
          $ref: '#/components/schemas/BrowserSelfProtectionControl'
        keyloggingProtection:
          $ref: '#/components/schemas/KeyloggingProtectionControl'
        browserLock:
          $ref: '#/components/schemas/BrowserLockControl'
        authenticationFactor:
          $ref: '#/components/schemas/AuthenticationFactorControl'
        sessionRefresh:
          $ref: '#/components/schemas/SessionRefreshControl'
        nativeMessagingHosts:
          $ref: '#/components/schemas/NativeMessagingHostsControl'
        allowedOrBlockedExtensions:
          $ref: '#/components/schemas/AllowedOrBlockedExtensionsControl'
        blockExtensionsByPermissions:
          $ref: '#/components/schemas/BlockExtensionsByPermissionsControl'
        postQuantumKeySecurity:
          $ref: '#/components/schemas/PostQuantumKeySecurityControl'
        strictOriginIsolation:
          description: Isolates every origin in its own agent-cluster, preventing scripts on one sub-domain from interacting with another.
          allOf:
            - $ref: '#/components/schemas/EnableDisableControl'
        advancedBrowserProtection:
          description: Stops zero-day WebAssembly attacks in real time by monitoring in-browser memory behavior and terminating malicious execution before any impact occurs.
          allOf:
            - $ref: '#/components/schemas/EnableDisableControl'
        userDataDirectoryProtection:
          description: Enforce hardware based detections to prevent data directory and browser session theft.
          allOf:
            - $ref: '#/components/schemas/EnableDisableControl'
        mobilePasswordSaving:
          description: Control passwords saving in the mobile browser.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        autofillOfForms:
          description: Control saving forms data in the browser.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        autofillOfCreditCards:
          description: Control saving credit cards in the browser.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        javaScriptRunningFromOmnibox:
          description: Control the ability to execute JavaScript code from the browser omnibox.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        pagesWithSslErrors:
          description: Block "Proceed to [FQDN] (unsafe)" option when getting an SSL error. Such errors might appear during SSL MitM attack.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        basicAuthenticationOverHttp:
          description: Set whether basic authentication can be used over HTTP websites.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        thirdPartyCookies:
          description: Set whether elements in the web page that aren't from the domain that's in the browser's address bar can set cookies.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        printPreview:
          description: Control the preview in the printing window, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        googleCloudPrint:
          description: Control the use of the Google Cloud Print, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        allowedPrinters:
          $ref: '#/components/schemas/AllowedPrintersControl'
        openLinksInExternalApps:
          $ref: '#/components/schemas/OpenLinksInExternalAppsControl'
        trustedCertificateAuthorities:
          $ref: '#/components/schemas/TrustedCertificateAuthoritiesControl'
        remoteHostFirewallTraversal:
          description: Manage whether Remote Desktop may connect from outside the LAN or VPN by traversing firewalls.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        endProcessViaTaskManager:
          description: Choose whether end users can end browser processes via the browser task manager.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        pdfium:
          description: Control the use of the PDFium library to render PDF pages, which might be exploited. When PDFium is disabled, encrypted PDF files won't be loaded in Prisma Browser.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        webGlApi:
          description: Control the use of the WebGL library, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        fileSystemApi:
          description: Control the use of the File System API, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        sensorsApi:
          description: Control the use of the Sensor API, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        webSerialApi:
          description: Control the use of the WebSerial API, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        webBluetoothApi:
          description: Control the use of the WebBluetooth API, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        webUsbApi:
          description: Control the use of the WebUSB API, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        webHidApi:
          description: Control the availability of the WebHID API, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        quicProtocol:
          description: Control the use of the QUIC protocol, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        webClipboardApi:
          description: Control the use of the Clipboard API, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        localFonts:
          description: Control the access to local fonts installed on the device, which might be exploited.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        flushBrowserData:
          $ref: '#/components/schemas/FlushBrowserDataControl'
        legacyPasswordManager:
          $ref: '#/components/schemas/LegacyPasswordManagerControl'
        hideSensitiveDataFromExtensions:
          description: Prevent all extensions from accessing cookies and authorization data sent by the browser.
          allOf:
            - $ref: '#/components/schemas/EnableDisableControl'
        remoteDebugging:
          description: Control remote debugging on Android and iOS devices to prevent data leaks and simplify troubleshooting.
          allOf:
            - $ref: '#/components/schemas/AllowBlockControl'
        internetExplorerCompatibilityMode:
          $ref: '#/components/schemas/InternetExplorerCompatibilityModeControl'
        launchingExternalApplications:
          $ref: '#/components/schemas/LaunchingExternalApplicationsControl'
        cookies:
          $ref: '#/components/schemas/CookiesControl'
        localNetworkAccessRestrictions:
          $ref: '#/components/schemas/LocalNetworkAccessRestrictionsControl'
        enhancedTrackingProtection:
          $ref: '#/components/schemas/EnhancedTrackingProtectionControl'
        forceHttps:
          $ref: '#/components/schemas/ForceHttpsControl'
        javaScriptV8JitAndWebAssembly:
          $ref: '#/components/schemas/JavaScriptV8JitAndWebAssemblyControl'
        restrictExtensionHostPermissions:
          $ref: '#/components/schemas/RestrictExtensionHostPermissionsControl'
        webRtc:
          $ref: '#/components/schemas/WebRtcControl'
        notifications:
          $ref: '#/components/schemas/NotificationsControl'
        popups:
          $ref: '#/components/schemas/PopupsControl'
        pagesWithInsecureContent:
          $ref: '#/components/schemas/PagesWithInsecureContentControl'
        kerberosDelegationAllowlist:
          $ref: '#/components/schemas/KerberosDelegationAllowlistControl'
        authenticationServerAllowlist:
          $ref: '#/components/schemas/AuthenticationServerAllowlistControl'
        concurrentNumberOfDevices:
          $ref: '#/components/schemas/ConcurrentNumberOfDevicesControl'
    SecurityResolvedRule:
      title: SecurityResolvedRule
      description: The resolved desired state of a Security rule, returned by create (POST 201) and full-replace (PUT 200). It mirrors the request body (scope, mode, controls) with all server-resolved defaults filled in, plus the assigned id. References are returned as IDs, not enriched with names; use GET-by-id for the enriched entity.
      type: object
      required:
        - id
        - name
        - mode
        - controls
      properties:
        id:
          type: string
          description: Unique identifier of the rule (PULID, 29 chars). In draft mode this is the entity ID.
          example: 0RL0123456789012345678901234
        name:
          type: string
          description: The name or title of the rule.
        description:
          type: string
          description: The detailed description of the rule.
        scope:
          $ref: '#/components/schemas/PostScope'
        mode:
          $ref: '#/components/schemas/RestrictedRuleMode'
        controls:
          $ref: '#/components/schemas/SecurityControls'
    SecurityRuleDetailed:
      title: SecurityRuleDetailed
      description: A detailed security rule object with complete configuration
      type: object
      required:
        - id
        - name
        - priority
        - mode
        - scope
        - metadata
      properties:
        id:
          type: string
          description: Unique identifier for the rule
        name:
          type: string
          description: User-friendly name for the rule
        priority:
          type: integer
          format: int32
          description: Order position of the rule in the list
        section:
          type: object
          nullable: true
          description: Section this rule belongs to (null if standalone)
          allOf:
            - $ref: '#/components/schemas/SectionRef'
        description:
          type: string
          description: Detailed explanation of the rule's purpose
        mode:
          $ref: '#/components/schemas/RestrictedRuleMode'
        scope:
          $ref: '#/components/schemas/GetScope'
        controls:
          $ref: '#/components/schemas/SecurityControls'
        metadata:
          type: object
          required:
            - createdBy
            - createdTime
            - lastUpdatedBy
            - lastUpdatedTime
          properties:
            configurationVersion:
              $ref: '#/components/schemas/MetadataConfigurationVersion'
            createdBy:
              readOnly: true
              type: string
              description: Email or identifier of the admin who created the rule
            createdTime:
              readOnly: true
              type: string
              format: date-time
              description: Timestamp when the rule was created
            lastUpdatedBy:
              readOnly: true
              type: string
              description: Email or identifier of the admin who last updated the rule
            lastUpdatedTime:
              readOnly: true
              type: string
              format: date-time
              description: Timestamp when the rule was last updated
    SelectedDeviceVendor:
      title: SelectedDeviceVendor
      type: object
      description: Device manufacturer with optional specific models
      properties:
        manufacturer:
          $ref: '#/components/schemas/DeviceManufacturer'
        models:
          type: array
          items:
            type: string
          description: Optional list of specific device models from this manufacturer
      required:
        - manufacturer
    SessionRefreshControl:
      title: SessionRefreshControl
      type: object
      nullable: true
      description: Periodically require the user to re-authenticate.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Session Refresh is enabled.
          enum:
            - enable
            - disable
        maxSessionDuration:
          type: string
          description: Maximum session duration before the user must re-authenticate. Applies when action is 'enable'. Defaults to '7days'.
          enum:
            - 1hour
            - 4hours
            - 9hours
            - 12hours
            - 24hours
            - 3days
            - 7days
            - 14days
            - 30days
        onBrowserClosed:
          type: boolean
          description: Whether to require re-authentication when the browser is closed. Applies when action is 'enable'.
    SignInRuleAction:
      title: SignInRuleAction
      type: string
      description: The action performed by the rule
      enum:
        - allow
        - block
        - prompt
    SignInRuleDetailed:
      title: SignInRuleDetailed
      description: A detailed sign-in rule object with complete configuration
      type: object
      required:
        - id
        - name
        - priority
        - description
        - mode
        - scope
        - action
        - metadata
      properties:
        id:
          type: string
          description: Unique identifier for the rule
        name:
          type: string
          description: User-friendly name for the rule
        priority:
          type: integer
          format: int32
          description: Order position of the rule in the list
        section:
          type: object
          nullable: true
          description: Section this rule belongs to (null if standalone)
          allOf:
            - $ref: '#/components/schemas/SectionRef'
        description:
          type: string
          description: Detailed explanation of the rule's purpose
        mode:
          $ref: '#/components/schemas/RestrictedRuleMode'
        scope:
          $ref: '#/components/schemas/GetScope'
        action:
          $ref: '#/components/schemas/SignInRuleAction'
        metadata:
          type: object
          required:
            - createdBy
            - createdTime
            - lastUpdatedBy
            - lastUpdatedTime
          properties:
            configurationVersion:
              $ref: '#/components/schemas/MetadataConfigurationVersion'
            createdBy:
              readOnly: true
              type: string
              description: Email or identifier of the admin who created the rule
            createdTime:
              readOnly: true
              type: string
              format: date-time
              description: Timestamp when the rule was created
            lastUpdatedBy:
              readOnly: true
              type: string
              description: Email or identifier of the admin who last updated the rule
            lastUpdatedTime:
              readOnly: true
              type: string
              format: date-time
              description: Timestamp when the rule was last updated
    SlackTenantCondition:
      title: SlackTenantCondition
      type: object
      properties:
        workspaceNames:
          type: array
          uniqueItems: true
          items:
            type: string
            maxLength: 100
          minItems: 1
          maxItems: 100
          description: List of allowed Slack workspace names
      required:
        - workspaceNames
      additionalProperties: false
    SocialLoginControl:
      title: SocialLoginControl
      type: object
      nullable: true
      description: Control consumer social login (OAuth) providers via Prisma Browser.
      required:
        - action
      properties:
        action:
          type: string
          description: Login restriction mode for consumer social login providers.
          enum:
            - allowAll
            - blockSpecific
        providers:
          type: array
          uniqueItems: true
          description: Social login providers to block. Required when action is 'blockSpecific' and not allowed when action is 'allowAll'.
          items:
            type: string
            enum:
              - google
              - microsoft
              - facebook
              - github
              - x
              - linkedin
              - apple
        googleAllowedDomains:
          type: array
          uniqueItems: true
          description: Google account domains exempted from the block (e.g. "@company.com"), allowing corporate Google Workspace users to log in even when consumer Google login is blocked. Each entry must be an '@' followed by a fully qualified domain name including a top-level domain. Underscores are not allowed. Internationalized domains must be punycode-encoded (e.g. "@xn--mnchen-3ya.de"). Only valid when action is 'blockSpecific' and 'google' is in providers.
          items:
            type: string
            minLength: 2
            maxLength: 255
            pattern: ^@[^@]+$
        userPrompt:
          description: 'How the user is prompted before the social login restriction is applied. durationMinutes is accepted for every mode except none: it sets how long the user''s own bypass lasts as well as how long an admin approval stays valid. Supported values run from ''10'' (10 minutes) to ''129600'' (90 days), matching the dashboard; ''0'' is rejected.'
          $ref: '#/components/schemas/UserPrompt'
        mfaRequired:
          type: boolean
          description: Whether the user must complete a step-up MFA challenge before social login is allowed. Only valid when action is 'allowAll'.
        customDialogText:
          $ref: '#/components/schemas/CustomDialogText'
    SuggestDefaultBrowserControl:
      title: SuggestDefaultBrowserControl
      type: object
      nullable: true
      description: Controls whether Prisma Browser suggests itself as the default browser to the user.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether Prisma Browser suggests becoming the default browser.
          enum:
            - suggest
            - doNotSuggest
    SuspendDevicesBadRequestResponse:
      description: Error envelope returned for 400 Bad Request from SuspendDevices. The error.code discriminates which validation failed.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          oneOf:
            - $ref: '#/components/schemas/InvalidDeviceIdError'
            - $ref: '#/components/schemas/InvalidStatusTransitionError'
          discriminator:
            propertyName: code
            mapping:
              INVALID_DEVICE_ID: '#/components/schemas/InvalidDeviceIdError'
              INVALID_STATUS_TRANSITION: '#/components/schemas/InvalidStatusTransitionError'
    SystemIntegrityPosture:
      title: SystemIntegrityPosture
      type: object
      required:
        - status
        - services
      properties:
        status:
          $ref: '#/components/schemas/SystemIntegrityPostureStatus'
        services:
          $ref: '#/components/schemas/SystemIntegrityPostureServices'
    SystemIntegrityPostureServices:
      title: SystemIntegrityPostureServices
      type: object
      properties:
        driversSigningEnforcement:
          type: boolean
        kernelDebugger:
          type: boolean
        secureBoot:
          type: boolean
        SIP:
          type: boolean
        gatekeeper:
          type: boolean
    SystemIntegrityPostureStatus:
      title: SystemIntegrityPostureStatus
      type: string
      description: System integrity status
      enum:
        - pass
        - fail
        - unknown
    Tag:
      title: Tag
      type: object
      description: An application tag
      properties:
        id:
          type: string
          description: Tag ID
        name:
          type: string
          description: Tag name
      required:
        - id
        - name
    TagIDsInput:
      type: array
      description: Replace the application custom tags with exactly this set of tag IDs.
      items:
        type: string
        pattern: ^0TG[0-9A-HJKMNP-TV-Z]{26}$
      maxItems: 63
    TenantConditions:
      title: TenantConditions
      type: object
      description: |
        Tenant restriction conditions for various cloud providers.
        Each provider section is optional. To remove a provider's restrictions, omit its section entirely.
      properties:
        google:
          $ref: '#/components/schemas/GoogleTenantCondition'
        googleCloudConsole:
          $ref: '#/components/schemas/GoogleCloudConsoleTenantCondition'
        aws:
          $ref: '#/components/schemas/AwsTenantCondition'
        microsoft365:
          $ref: '#/components/schemas/Microsoft365TenantCondition'
        slack:
          $ref: '#/components/schemas/SlackTenantCondition'
        openai:
          $ref: '#/components/schemas/OpenAITenantCondition'
        github:
          $ref: '#/components/schemas/GitHubTenantCondition'
        claudeai:
          $ref: '#/components/schemas/ClaudeAITenantCondition'
      additionalProperties: false
    ThemeColorControl:
      title: ThemeColorControl
      type: object
      nullable: true
      description: Set Prisma Browser's theme color.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether end users choose their own theme color or the admin applies a fixed color.
          enum:
            - userChoice
            - custom
        color:
          type: string
          description: Theme color applied to Prisma Browser.
          pattern: ^#[0-9a-fA-F]{6}$
    TrafficFlowControl:
      title: TrafficFlowControl
      type: object
      nullable: true
      description: Choose the way the Prisma Browser handles network traffic.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: How browser network traffic is routed through Prisma Access
          enum:
            - privateApplicationTrafficOnly
            - allTraffic
            - doNotRouteThroughPrismaAccess
    TrustedCertificateAuthoritiesControl:
      title: TrustedCertificateAuthoritiesControl
      type: object
      nullable: true
      description: Choose the certificate authorities trusted by Prisma Browser.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Which certificate store the browser uses to validate TLS/SSL certificates.
          enum:
            - deviceTrustStore
            - prismaBrowserTrustStore
            - none
          default: deviceTrustStore
        additionalCertificates:
          type: array
          description: Extra trusted CA certificates the browser honors in addition to the chosen store.
          maxItems: 100
          items:
            type: object
            additionalProperties: false
            required:
              - name
              - content
            properties:
              name:
                type: string
                description: Display name for the certificate.
                minLength: 1
                pattern: \S
              content:
                type: string
                description: The certificate itself, as a single base64 string.
                minLength: 1
                maxLength: 1048576
                pattern: \S
    UnexpectedDeviceStatusError:
      description: One or more devices were not in the status expected for this action.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - UNEXPECTED_DEVICE_STATUS
              description: Discriminator - always "UNEXPECTED_DEVICE_STATUS".
    UnprocessableEntityError:
      description: The request was well-formed but could not be processed.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - UNPROCESSABLE_ENTITY
              description: Discriminator - always "UNPROCESSABLE_ENTITY".
    UnprocessableEntityResponse:
      description: Error envelope returned for 422 Unprocessable Entity responses.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/UnprocessableEntityError'
    UnsupportedOperationError:
      title: UnsupportedOperationError
      description: The requested operation is not supported (e.g. draft mode is not enabled for the tenant).
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - UNSUPPORTED_OPERATION
              description: Discriminator - always "UNSUPPORTED_OPERATION".
    UnsupportedOperationResponse:
      title: UnsupportedOperationResponse
      description: Error envelope returned for 501 Not Implemented responses.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/UnsupportedOperationError'
    UrlInput:
      title: UrlInput
      type: object
      properties:
        url:
          type: string
          description: URL pattern expression
        strict_mode:
          type: boolean
          default: false
          description: |
            If `true`, the URL is saved exactly as entered. 
            If `false` (default), the system automatically normalizes the URL based on the App Type:

            **Custom Apps:**
            * **Protocol:** Defaults to `*://` if omitted.
            * **Subdomain:** Defaults to `www` logic (hidden).
            * **Path:** Appends `/*` if no path is specified.

            **Private Apps:**
            * **Protocol:** Defaults to `https://`. Wildcards (`*`) are **NOT** allowed.
            * **Subdomain:** No automatic `www` handling; `www` is treated as a unique prefix.
            * **Domain:** Supports IPv4 and Port numbers (e.g., `:8080`).
            * **Path:** Automatically adds a trailing `*` to all paths.
      required:
        - url
    UrlsInput:
      title: UrlsInput
      type: array
      description: 'URL patterns for the application. The per-application limit is configurable per tenant (default: 100, maximum: 15000).'
      items:
        $ref: '#/components/schemas/UrlInput'
      maxItems: 15000
      minItems: 1
    User:
      title: User
      type: object
      properties:
        id:
          type: string
          description: Unique identifier
        externalId:
          type: string
          description: External identifier
        email:
          type: string
          description: Email
        lastSeen:
          readOnly: true
          type: string
          format: date-time
          description: Last seen time
        firstSeen:
          readOnly: true
          type: string
          format: date-time
          description: First seen time
        name:
          type: string
          description: Name
        profilePictureURL:
          type: string
          description: Profile Picture URL
        deletedTime:
          readOnly: true
          type: string
          format: date-time
          description: Deleted Time
        status:
          $ref: '#/components/schemas/UserStatus'
        provider:
          type: string
          description: Provider
          enum:
            - saml
            - local
            - oidc
        deviceIds:
          type: array
          description: Device IDs
          items:
            type: string
        userGroups:
          type: array
          description: User Groups
          items:
            $ref: '#/components/schemas/UserGroup'
      required:
        - id
        - email
        - lastSeen
        - firstSeen
        - name
        - profilePictureURL
        - deletedTime
        - status
        - provider
        - externalId
    UserAgentControl:
      title: UserAgentControl
      type: object
      nullable: true
      description: Set additional User-Agent component to the default User-Agent string to identify HTTP/S requests. This control is moving to Access & Data Controls, which replaces the Browser Customization location. During rollout it remains under Browser Customization; once available under Access & Data Controls, new rules are created there and take precedence over any existing Browser Customization rule.
      additionalProperties: false
      required:
        - mode
      properties:
        mode:
          type: string
          description: Whether to use the default User-Agent or append an additional component.
          enum:
            - default
            - custom
        additionalComponent:
          $ref: '#/components/schemas/HttpHeaderValue'
    UserBadRequestResponse:
      description: Error envelope returned for 400 Bad Request from user status-change endpoints.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/InvalidUserIdError'
    UserForceReauthResponse:
      title: UserForceReauthResponse
      type: object
      properties:
        message:
          type: string
          example: Force re-authentication initiated for 2 users
    UserGroup:
      title: UserGroup
      type: object
      properties:
        id:
          type: string
          description: Unique identifier
        name:
          type: string
          description: Name
        lastUpdated:
          readOnly: true
          type: string
          format: date-time
          description: Last updated
        createdAt:
          readOnly: true
          type: string
          format: date-time
          description: Created at
        provider:
          type: string
          enum:
            - sso
            - local
          description: Provider
      required:
        - id
        - name
    UserGroupRef:
      title: UserGroupRef
      type: object
      description: A reference to a user group entity.
      required:
        - id
        - name
      properties:
        id:
          type: string
          description: User group identifier
        name:
          type: string
          description: User group display name
    UserPrompt:
      title: UserPrompt
      description: 'How an end user is prompted before a control''s restriction is applied, and how long their decision is remembered. Optional; absence is equivalent to { mode: "none" } — no prompt is shown.'
      type: object
      required:
        - mode
      additionalProperties: false
      properties:
        mode:
          type: string
          description: 'What the user sees when the restriction triggers. none: no prompt, restriction is enforced silently. warnAndAllow: pop-up warning shown; user can continue. proceedWithReason: pop-up shown; user must enter a reason before continuing. adminApproval: pop-up shown; user submits a permission request an admin must approve. Explicit mode=none is accepted and is equivalent to omitting userPrompt.'
          enum:
            - none
            - warnAndAllow
            - proceedWithReason
            - adminApproval
        durationMinutes:
          description: How long the user's decision is remembered before they are prompted again. Which modes accept it depends on the control. A control that only remembers an admin approval accepts it when mode is adminApproval and rejects it otherwise; the login controls (formLogin, idpLogin, socialLogin, passkeyLogin) also remember the user's own bypass, so they accept it for every mode except none. When it is omitted for a mode that accepts it, the server defaults to '540' (9 hours), matching the dashboard UI default.
          allOf:
            - $ref: '#/components/schemas/OverrideDurationMinutes'
    UserRef:
      title: UserRef
      type: object
      description: A reference to a user entity.
      required:
        - id
        - name
        - email
      properties:
        id:
          type: string
          description: User identifier
        name:
          type: string
          description: User display name
        email:
          type: string
          description: User email address
    UserRequest:
      type: object
      properties:
        id:
          type: string
          format: string
          description: Unique identifier
        userId:
          type: string
          format: string
          description: Request unique identifier
        type:
          type: string
          format: string
          description: Request type
        status:
          type: string
          format: string
          description: Request status
        url:
          type: string
          format: string
          description: bypassing url
        reason:
          type: string
          format: string
          description: reason for request
        deviceId:
          type: string
          format: string
          description: Device unique identifier
        ruleId:
          type: string
          format: string
          description: Blocking rule unique identifier
        adminComment:
          type: string
          format: string
          description: Admin comment
        createdAt:
          type: string
          format: date-time
          description: Request created at
        userAcceptedAt:
          type: string
          format: date-time
          description: User accepted response at
        responseTime:
          type: string
          format: date-time
          description: Admin response time
        adminBypassTimeframe:
          type: integer
          format: string
          description: The timeframe for which the approval is valid
        respondedBy:
          type: string
          format: string
          description: Response by
        revokedBy:
          type: string
          format: string
          description: Revoked by
        revokedAt:
          type: string
          format: date-time
          description: Admin revoke time
        revokerComment:
          type: string
          format: string
          description: Revoke comment
        remoteApplication:
          type: object
          properties:
            name:
              type: string
              format: string
              description: Remote connection
            address:
              type: string
              format: string
              description: IP Address
            port:
              type: integer
              description: Port
            protocol:
              type: string
              format: string
              description: Protocol
      required:
        - id
        - userId
        - status
        - type
        - url
        - reason
        - ruleId
        - createdAt
        - deviceId
    UserResumeResponse:
      title: UserResumeResponse
      type: object
      properties:
        message:
          type: string
          example: Users resumed successfully
    UserStatus:
      title: UserStatus
      type: string
      description: User status
      enum:
        - active
        - suspended
    UserStatusChangeRequest:
      title: UserStatusChangeRequest
      type: object
      properties:
        userIds:
          type: array
          items:
            type: string
          description: List of user IDs
          minItems: 1
      required:
        - userIds
    UserSuspendResponse:
      title: UserSuspendResponse
      type: object
      properties:
        message:
          type: string
          example: Users suspended successfully
    UsersNotFoundError:
      description: One or more of the requested users were not found.
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - USERS_NOT_FOUND
              description: Discriminator - always "USERS_NOT_FOUND".
    UsersNotFoundResponse:
      description: Error envelope returned when one or more users are not found.
      type: object
      required:
        - error
      additionalProperties: false
      properties:
        error:
          $ref: '#/components/schemas/UsersNotFoundError'
    ValidationError:
      title: ValidationError
      description: Generic input validation failed (no field-level breakdown).
      allOf:
        - $ref: '#/components/schemas/BaseApiError'
        - type: object
          properties:
            code:
              type: string
              enum:
                - VALIDATION_ERROR
              description: Discriminator - always "VALIDATION_ERROR".
    WatermarkControl:
      title: WatermarkControl
      type: object
      description: Control webpage watermarking to deter users from taking screenshots using external means (e.g. mobile device).
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Action for the watermark control.
          enum:
            - enable
            - disable
        settings:
          description: Watermark appearance settings. Only valid when action is enable. All fields are optional; defaults are applied for any omitted field.
          $ref: '#/components/schemas/WatermarkControlSettings'
    WatermarkControlSettings:
      title: WatermarkControlSettings
      type: object
      description: Watermark appearance settings. Only valid when the watermark action is enable. Every field is optional; an omitted field uses its default.
      additionalProperties: false
      properties:
        opacityPercentage:
          type: integer
          description: Opacity of the watermark as a percentage. Defaults to 25.
          minimum: 0
          maximum: 100
          default: 25
        rotationDegrees:
          type: string
          description: Rotation angle of the watermark in degrees. Defaults to "0".
          enum:
            - '0'
            - '45'
            - '-45'
          default: '0'
        densityLevel:
          type: string
          description: Density of the watermark. Defaults to standard.
          enum:
            - low
            - standard
            - high
          default: standard
        logoColor:
          type: string
          description: Color of the watermark logo. Defaults to white.
          enum:
            - white
            - standard
          default: white
        showCompanyLogo:
          type: boolean
          description: Show company logo in the watermark. Omitted fields are preserved from the existing directive; defaults to true on first create.
        showTextDetails:
          type: boolean
          description: Show text details (email, timestamp) in the watermark. Omitted fields are preserved from the existing directive; defaults to true on first create.
        showQrCode:
          type: boolean
          description: Show QR code in the watermark. Omitted fields are preserved from the existing directive; defaults to false on first create.
    WebClassification:
      title: WebClassification
      description: Web classification (URL category) for content filtering
      type: string
      enum:
        - Abortion
        - AbusedDrugs
        - Adult
        - AICodeAssistant
        - AIConversationalAssistant
        - AIDataAndWorkflowOptimizer
        - AIMeetingAssistant
        - AIMediaService
        - AIPlatformService
        - AIWebsiteGenerator
        - AIWritingAssistant
        - AlcoholAndTobacco
        - ArtificialIntelligence
        - Auctions
        - BusinessAndEconomy
        - CommandAndControl
        - CompromisedWebsite
        - ComputerAndInternetInfo
        - ContentDeliveryNetworks
        - CopyrightInfringement
        - Cryptocurrency
        - Dating
        - DynamicDNS
        - EducationalInstitutions
        - EncryptedDNS
        - EntertainmentAndArts
        - Extremism
        - FileConverter
        - FinancialServices
        - Gambling
        - Games
        - Government
        - Grayware
        - Hacking
        - HealthAndMedicine
        - HomeAndGarden
        - HuntingAndFishing
        - InsufficientContent
        - InternetCommunicationsAndTelephony
        - InternetPortals
        - JobSearch
        - Legal
        - Malware
        - Marijuana
        - Military
        - MotorVehicles
        - Music
        - News
        - NewlyRegisteredDomain
        - Nudity
        - OnlineStorageAndBackup
        - Parked
        - PeerToPeer
        - PersonalSitesAndBlogs
        - Phishing
        - PhilosophyAndPoliticalAdvocacy
        - PrivateIPAddresses
        - ProxyAvoidanceAndAnonymizers
        - Questionable
        - Ransomware
        - RealEstate
        - RealTimeDetection
        - RecreationAndHobbies
        - ReferenceAndResearch
        - Religion
        - RemoteAccess
        - RiskLevelHigh
        - RiskLevelLow
        - RiskLevelMedium
        - ScanningActivity
        - SearchEngines
        - SexEducation
        - SharewareAndFreeware
        - Shopping
        - SocialNetworking
        - Society
        - Sports
        - StockAdviceAndTools
        - StreamingMedia
        - SwimsuitsAndIntimateApparel
        - TrainingAndTools
        - Translation
        - Travel
        - Unknown
        - Weapons
        - WebAdvertisements
        - WebBasedEmail
        - WebHosting
    WebClassifications:
      title: WebClassifications
      description: Array of web classifications (URL categories) for content filtering
      type: array
      uniqueItems: true
      minItems: 1
      maxItems: 100
      items:
        $ref: '#/components/schemas/WebClassification'
    WebRtcControl:
      title: WebRtcControl
      type: object
      nullable: true
      description: Control the use of WebRTC mechanism, which might be exploited. Disabling it might impact the usability of websites working with WebRTC functionalities, like call/video streaming.
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether to allow or block WebRTC.
          enum:
            - allow
            - block
        excludedDomains:
          type: array
          description: Domains excluded from the block action.
          maxItems: 1000
          uniqueItems: true
          items:
            $ref: '#/components/schemas/Domain'
    WebUrl:
      title: WebUrl
      type: string
      description: 'A web URL: an absolute http(s)/ftp URL, or a schemeless host (e.g. "example.com"). Dangerous schemes (javascript:, data:, …) are rejected. Precise host rules are enforced server-side.'
      maxLength: 2000
      pattern: ^(?:(?:[Hh][Tt][Tt][Pp][Ss]?|[Ff][Tt][Pp])://|[^\s:/?#]+\.[^\s:/?#]+)
    WebUserInteractionControl:
      title: WebUserInteractionControl
      type: object
      description: Control webpage functionality by removing or hiding selected elements from end users, ensuring only authorized actions remain available.
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          description: Whether web user interaction control is enabled.
          enum:
            - enable
            - disable
        selectors:
          type: array
          maxItems: 1000
          description: List of webpage elements to hide. Required and non-empty when action is enable; must be omitted or empty when action is disable.
          items:
            type: object
            additionalProperties: false
            required:
              - name
              - selector
            properties:
              name:
                type: string
                minLength: 1
                maxLength: 256
                pattern: \S
                description: Human-readable name of the element being hidden.
              selector:
                type: string
                minLength: 1
                maxLength: 2048
                pattern: \S
                description: CSS selector identifying the element to hide on the page.
    WebpageDataMaskingControl:
      title: WebpageDataMaskingControl
      type: object
      nullable: true
      additionalProperties: false
      required:
        - action
      properties:
        action:
          type: string
          enum:
            - enable
            - disable
        maskType:
          type: string
          enum:
            - maskAll
            - showFirst
            - showLast
        visibleCharacterCount:
          type: string
          enum:
            - '1'
            - '2'
            - '3'
            - '4'
        userPrompt:
          $ref: '#/components/schemas/UserPrompt'
    WebpageFrame:
      description: |
        Colored frame displayed around the webpage indicating a regulated or classified environment.
        Including this object enables the frame; omitting it disables it.
      type: object
      required:
        - color
      additionalProperties: false
      properties:
        color:
          type: string
          description: Color of the frame border displayed around the webpage.
          enum:
            - '#F01370'
            - '#0094FF'
            - '#BF79FF'
            - '#FC7910'
            - '#838383'
            - '#00A352'
            - '#F04C4C'
            - '#00AED5'
            - '#42A391'
            - '#C18D08'
        text:
          type: string
          description: Text displayed on the frame (e.g. environment classification or compliance notice).
          maxLength: 255
    WinFileExistenceMetadata:
      title: WinFileExistenceMetadata
      type: object
      properties:
        path:
          type: string
          description: Full path to the file on Windows
        certificateThumbprint:
          type: string
          description: Certificate thumbprint to validate the file signature
      required:
        - path
    WinRunningProcessMetadata:
      title: WinRunningProcessMetadata
      type: object
      properties:
        name:
          type: string
          description: Process name or path on Windows
        certificateThumbprint:
          type: string
          description: Certificate thumbprint to validate the process signature
      required:
        - name
    WindowsEdition:
      title: WindowsEdition
      type: string
      description: Windows edition
      enum:
        - Pro
        - Enterprise
        - Home
        - Server
        - Education
    WindowsVersion:
      title: WindowsVersion
      type: object
      properties:
        enabled:
          type: boolean
        major:
          type: string
        minBuildNumber:
          type: string
        editions:
          type: array
          items:
            $ref: '#/components/schemas/WindowsEdition'
      required:
        - enabled
        - major
    WindowsVersionAttribute:
      title: WindowsVersionAttribute
      type: object
      properties:
        any:
          type: boolean
          default: false
        versions:
          type: array
          items:
            $ref: '#/components/schemas/WindowsVersion'
    metadata:
      title: metadata
      type: object
      properties:
        createdTime:
          readOnly: true
          type: string
          format: date-time
          description: Creation time
        lastUpdatedTime:
          readOnly: true
          type: string
          format: date-time
          description: Last update time
        createdBy:
          readOnly: true
          type: string
          description: Created by user
        lastUpdatedBy:
          readOnly: true
          type: string
          description: Updated by user
        configurationVersion:
          $ref: '#/components/schemas/MetadataConfigurationVersion'
      required:
        - createdTime
        - lastUpdatedTime
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT