OCI APIs Ingested by Prisma Cloud

The following table lists all the OCI APIs and their permissions that Prisma Cloud supports for your OCI-related assets.

It is recommended that you update your existing Terraform template to support the new permissions. The new Terraform template update eliminates the need to contact OCI to request a service limit extension for the policy statements.

Service	API Name in Prisma Cloud	Permissions (New Format)
Current as of:	April 10, 2026
OCI Analytics	oci-analytics-instance	ANALYTICS_INSTANCE_INSPECT ANALYTICS_INSTANCE_READ
OCI API Management	oci-apimanagement-apigateway oci-apimanagement-apigateway-deployment	API_GATEWAY_LIST API_GATEWAY_READ API_DEPLOYMENT_LIST API_DEPLOYMENT_READ
OCI Bastion	oci-bastion	BASTION_INSPECT BASTION_READ BASTION_SESSION_INSPECT BASTION_SESSION_READ
OCI Big Data Service	oci-bigdataservice-instances	BDS_INSPECT BDS_READ
OCI Block Storage	oci-block-storage-volume oci-block-storage-volume-backup oci-block-storage-volume-group oci-block-storage-boot-volume oci-block-storage-boot-volume-attachment	VOLUME_BACKUP_INSPECT VOLUME_BACKUP_READ VOLUME_INSPECT BACKUP_POLICY_ASSIGNMENT_INSPECT VOLUME_GROUP_INSPECT COMPARTMENT_INSPECT VOLUME_INSPECT VOLUME_ATTACHMENT_INSPECT VOLUME_ATTACHMENT_READ
OCI Block Storage	oci-block-storage-volume-attachment	VOLUME_ATTACHMENT_INSPECT VOLUME_ATTACHMENT_READ
OCI Budgets	oci-budgets-budget	USAGE_BUDGET_INSPECT USAGE_BUDGET_READ
OCI Certificate	oci-certificate-certificateauthorities oci-certificate-certificates	CERTIFICATE_AUTHORITY_INSPECT CERTIFICATE_AUTHORITY_READ CERTIFICATE_INSPECT CERTIFICATE_READ
OCI Cloud Guard	oci-cloudguard-security-recipe oci-cloudguard-security-zone oci-cloudguard-detector-recipe oci-cloudguard-configuration	SECURITY_RECIPE_INSPECT SECURITY_RECIPE_READ SECURITY_ZONE_INSPECT SECURITY_ZONE_READ CG_DETECTOR_RECIPE_INSPECT CG_DETECTOR_RECIPE_READ CG_TARGET_INSPECT CG_TARGET_READ CG_CONFIG_INSPECT CG_CONFIG_READ
OCI Compute	oci-compute-instance oci-compute-boot-volume-backup oci-compute-image oci-compute-vnicattachments oci-compute-vnics	INSTANCE_INSPECT INSTANCE_READ BOOT_VOLUME_BACKUP_INSPECT BOOT_VOLUME_BACKUP_READ INSTANCE_IMAGE_INSPECT INSTANCE_IMAGE_READ VNIC_ATTACHMENT_READ VNIC_READ
OCI Containers And Artifacts	oci-containers-artifacts-kubernetes-cluster oci-containers-artifacts-kubernetes-cluster-nodepool oci-containers-artifacts-containerimages oci-containers-artifacts-containerrepo	CLUSTER_INSPECT CLUSTER_NODE_POOL_INSPECT CLUSTER_NODE_POOL_READ CLUSTER_READ REPOSITORY_INSPECT REPOSITORY_READ
OCI Data Catalog	oci-datacatalog-catalogs	CATALOG_INSPECT CATALOG_READ
OCI Data Flow	oci-dataflow-applications This API is not supported in ap-hyderabad-1 region.	DATAFLOW_APPLICATION_INSPECT DATAFLOW_APPLICATION_READ
OCI Data Integration	oci-dataintegration-workspaces	DIS_WORKSPACE_INSPECT DIS_WORKSPACE_READ
OCI Data Safe	oci-data-safe-private-endpoint oci-data-safe-target-database	DATA_SAFE_PRIVATE_ENDPOINT_INSPECT DATA_SAFE_PRIVATE_ENDPOINT_READ DATA_SAFE_TARGET_DATABASE_READ DATA_SAFE_TARGET_DATABASE_INSPECT
OCI Data Safe	oci-data-safe-configuration	DATA_SAFE_READ
OCI Data Science	oci-datascience-projects	DATA_SCIENCE_PROJECT_INSPECT DATA_SCIENCE_PROJECT_READ
OCI Database	oci-database-autonomous-database oci-oracledatabase-bmvm-dbsystem oci-oracledatabase-databases oci-database-db-home oci-database-db-home-patch oci-database-db-system-patch oci-database-db-node oci-database-keystore	AUTONOMOUS_DATABASE_INSPECT DB_HOME_INSPECT DB_SYSTEM_INSPECT DATABASE_INSPECT DB_NODE_INSPECT DB_NODE_QUERY KEY_STORE_INPSECT
OCI DataLabeling	oci-datalabeling-dataset	DATA_LABELING_DATASET_INSPECT DATA_LABELING_DATASET_READ
OCI Events	oci-events-rule	EVENTRULE_LIST EVENTRULE_READ
OCI File Storage	oci-file-storage-file-system oci-file-storage-export oci-file-storage-mount-target	FILE_SYSTEM_INSPECT FILE_SYSTEM_READ EXPORT_SET_INSPECT EXPORT_SET_READ COMPARTMENT_INSPECT MOUNT_TARGET_INSPECT MOUNT_TARGET_READ
OCI Functions	oci-functions-applications oci-functions	FN_APP_LIST FN_APP_READ FN_FUNCTION_LIST FN_FUNCTION_READ
OCI IAM	oci-iam-user oci-iam-group oci-iam-policy oci-iam-authentication-policy oci-iam-identityproviders oci-iam-dynamic-group oci-iam-compartment oci-iam-tag-default	USER_INSPECT USER_READ GROUP_INSPECT POLICY_READ AUTHENTICATION_POLICY_INSPECT IDENTITY_PROVIDER_INSPECT DYNAMIC_GROUP_INSPECT COMPARTMENT_INSPECT TAG_DEFAULT_INSPECT
OCI Integration	oci-integration-instance	INTEGRATION_INSTANCE_INSPECT INTEGRATION_INSTANCE_READ
OCI JMS	oci-jms-fleet	FLEET_INSPECT FLEET_READ
OCI Logging	oci-logging-logs	LOG_GROUP_INSPECT LOG_GROUP_READ
OCI MySQL	oci-mysql-dbsystems	MYSQL_INSTANCE_INSPECT MYSQL_INSTANCE_READ
OCI Networking	oci-networking-vcn oci-networking-nsg oci-networking-security-list oci-networking-loadbalancer oci-networking-routetable oci-networking-internetgateway oci-networking-drgattachment oci-networking-drg oci-networking-localpeeringgateway oci-networking-natgateway oci-networking-servicegateway oci-networking-dns-zone oci-networking-dns-tsigkeys oci-networking-subnet oci-networking-ipsec-connection oci-networking-networkloadbalancer oci-networking-private-ip oci-networking-public-ip	VCN_READ NETWORK_SECURITY_GROUP_INSPECT NETWORK_SECURITY_GROUP_READ SECURITY_LIST_READ LOAD_BALANCER_INSPECT ROUTE_TABLE_READ SUBNET_READ INTERNET_GATEWAY_READ DRG_ATTACHMENT_READ DRG_READ LOCAL_PEERING_GATEWAY_READ NAT_GATEWAY_READ SERVICE_GATEWAY_READ DNS_ZONE_INSPECT DNS_TSIG_KEY_INSPECT DNS_TSIG_KEY_READ IPSEC_CONNECTION_READ NETWORK_LOAD_BALANCER_INSPECT NETWORK_LOAD_BALANCER_READ SUBNET_READ PRIVATE_IP_READ PUBLIC_IP_READ
OCI NoSQL Database	oci-nosql-database-table	NOSQL_TABLE_INSPECT NOSQL_TABLE_READ
OCI Notifications	oci-notifications-ons-topic	ONS_SUBSCRIPTION_INSPECT ONS_TOPIC_INSPECT ONS_TOPIC_READ
OCI Object Storage	oci-object-storage-bucket	BUCKET_INSPECT BUCKET_READ OBJECTSTORAGE_NAMESPACE_READ
OCI Object Storage	oci-object-storage-preauthenticated-requests	BUCKET_INSPECT BUCKET_READ OBJECTSTORAGE_NAMESPACE_READ
OCI Scanning	oci-scanning-host-scanrecipe oci-scanning-host-scantarget	VSS_HOSTSCANRECIPE_INSPECT VSS_HOSTSCANRECIPE_READ VSS_HOSTSCANTARGET_INSPECT VSS_HOSTSCANTARGET_READ
OCI Service Catalog	oci-servicecatalog-catalog	SERVICE_CATALOG_INSPECT SERVICE_CATALOG_READ
OCI Service Connector Hub	oci-serviceconnectorhub-serviceconnectors	SERVICE_CONNECTOR_INSPECT SERVICE_CONNECTOR_READ
OCI Service Mesh	oci-service-mesh-access-policy oci-service-mesh-meshes oci-service-mesh-virtual-deployment oci-service-mesh-virtualservice-routetable oci-service-mesh-virtualservice oci-service-mesh-ingressgateway-routetable oci-service-mesh-ingressgateway	MESH_ACCESS_POLICY_LIST MESH_ACCESS_POLICY_READ SERVICE_MESH_LIST SERVICE_MESH_READ MESH_VIRTUAL_DEPLOYMENT_LIST MESH_VIRTUAL_DEPLOYMENT_READ MESH_VIRTUAL_DEPLOYMENT_PROXY_CONFIG_READ MESH_PROXY_DETAILS_READ MESH_VIRTUAL_SERVICE_ROUTE_TABLE_LIST MESH_VIRTUAL_SERVICE_ROUTE_TABLE_READ MESH_VIRTUAL_SERVICE_LIST MESH_VIRTUAL_SERVICE_READ MESH_INGRESS_GATEWAY_ROUTE_TABLE_LIST MESH_INGRESS_GATEWAY_ROUTE_TABLE_READ MESH_INGRESS_GATEWAY_LIST MESH_INGRESS_GATEWAY_READ
OCI Speech	oci-speech-transcription-job	AI_SERVICE_SPEECH_TRANSCRIPTION_JOB_INSPECT AI_SERVICE_SPEECH_TRANSCRIPTION_JOB_READ
OCI Streaming	oci-streaming-streampools oci-streaming-streams	STREAM_INSPECT STREAM_POOL_INSPECT STREAM_POOL_READ STREAM_READ
OCI Vaults	oci-vault-keyvault	VAULT_INSPECT VAULT_READ
OCI Vaults	oci-vault-secrets	SECRET_INSPECT
OCI Vaults	oci-vault-key	KEY_INSPECT KEY_READ
OCI Vaults	oci-vault-secret-versions	SECRET_INSPECT SECRET_VERSION_INSPECT
OCI Vision	oci-vision-model oci-vision-project	AI_SERVICE_VISION_MODEL_INSPECT AI_SERVICE_VISION_MODEL_READ AI_SERVICE_VISION_PROJECT_INSPECT AI_SERVICE_VISION_PROJECT_READ
OCI Web Application Firewall	oci-waf-webappfirewallpolicy oci-waf-networkaddresslist oci-waf-waaspolicy oci-waf-waasaddresslist oci-loadbalancer-waf	WAF_POLICY_INSPECT WAF_POLICY_READ WAF_NETWORK_ADDRESS_LIST_INSPECT WAF_NETWORK_ADDRESS_LIST_READ WAAS_POLICY_INSPECT WAAS_POLICY_READ WAAS_ADDRESS_LIST_INSPECT WAAS_ADDRESS_LIST_READ WEB_APP_FIREWALL_INSPECT WEB_APP_FIREWALL_READ