---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Prisma Cloud REST Messages

# Prisma Cloud REST Messages {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Prisma REST messages are used to make calls to the Prisma Application Programming Interface (API) to fetch the compliance data.

The following REST messages are shipped with the base system.

## Prisma Cloud integrations {#prisma-cloud-rest-messages__section_y5g_npf_t1c}

All Prisma Cloud integrations use the JSON Web Token (JWT) for authentication and authorization.  
{#prisma-cloud-rest-messages__table_v2g_x1q_dt__entry__5}

| Endpoint | Description | Method | Body | API documentation link |
|-|-|-|-|-|
| /login | Obtains the JWT token for use in all subsequent integrations. | POST | { "username": <<access key id >>, "password": <<secret access key>>} | <https://pan.dev/prisma-cloud/api/cspm/app-login/> |
[Table 1. Prisma Login REST message]

{#prisma-cloud-rest-messages__table_v2g_x1q_dt}  
{#prisma-cloud-rest-messages__table_etm_nrf_t1c__entry__5}

| Endpoint | Description | Method | Body | API documentation link |
|-|-|-|-|-|
| /auth_token/extend | Automatically renews the JWT token on expiration. The default duration for token expiry is 60 minutes. | GET | NA | <https://pan.dev/prisma-cloud/api/cspm/extend-session/> |
[Table 2. Prisma Refresh Token REST message]

{#prisma-cloud-rest-messages__table_etm_nrf_t1c}  
{#prisma-cloud-rest-messages__table_ejz_lrb_51c__entry__5}

| Endpoint | Description | Method | Body | API documentation link |
|-|-|-|-|-|
| /v2/policy | Retrieves all the policy data from Prisma. | GET | NA | <https://pan.dev/prisma-cloud/api/cspm/get-policies/> |
[Table 3. Prisma Policy REST message]

{#prisma-cloud-rest-messages__table_ejz_lrb_51c}  
{#prisma-cloud-rest-messages__table_tjw_nrf_t1c__entry__5}

| Endpoint | Description | Method | Body | API documentation link |
|-|-|-|-|-|
| /v2/alert | Retrieves all alerts from Prisma. | POST | { "detailed": "false", "filters": [ { "name": "timeRange.type", "operator": "=", "value": "ALERT_STATUS_UPDATED" } ], "sortBy": [ "resource.id" ], "pageToken": "", "offset": 0, "limit": 2000, "timeRange": { "type": "absolute", "value": { "startTime": <<Import since at integration level>>, "endTime": << Current integration  run time>> } } } | <https://pan.dev/prisma-cloud/api/cspm/post-alerts/> |
[Table 4. Prisma Alert REST Message]

{#prisma-cloud-rest-messages__table_tjw_nrf_t1c}

For Prisma Comprehensive Alert integration, the filters in the above POST body must be replaced as follows:  

    "filters": [
    	{
                        "name": "alert.status",
                        "operator": "=",
                        "value": "open"
                    },
                    {
                        "name": "alert.status",
                        "operator": "=",
                        "value": "dismissed"
                    },
                    {
                        "name": "alert.status",
                        "operator": "=",
                        "value": "snoozed"
                    },
                    {
                        "name": "alert.status",
                        "operator": "=",
                        "value": "pending_resolution"
                    },
                    {
                        "name": "timeRange.type",
                        "operator": "=",
                        "value": "ALERT_UPDATED"
                    }
     
        ],