prisma-airs-sdk

TypeScript SDK for Palo Alto Networks Prisma AIRS — covering the full lifecycle from configuration management to operational scanning across all three service domains: AI Runtime Security, AI Red Teaming, and Model Security.

Installation

npm install @cdot65/prisma-airs-sdk

Requires Node.js 18+. Zero external HTTP dependencies (native fetch + crypto).

What's Included

| Service | Client | Auth | Capabilities | | ----------------------- | --------------------- | ------- | ---------------------------------------------------------- | | AI Runtime Security | Scanner | API Key | Sync/async content scanning, prompt injection detection | | Management | ManagementClient | OAuth2 | Profiles, topics, API keys, apps, DLP, deployment, logs | | Model Security | ModelSecurityClient | OAuth2 | ML model scanning, security groups, rule management | | AI Red Teaming | RedTeamClient | OAuth2 | Automated red team scans, reports, targets, custom attacks |

All OAuth2 services share credentials and handle token lifecycle automatically (caching, proactive refresh, 401/403 auto-retry).

Quick Start

AI Runtime Security — Content Scanning (API Key)

import { init, Scanner, Content } from '@cdot65/prisma-airs-sdk';

init({ apiKey: 'YOUR_API_KEY' });

const scanner = new Scanner();
const content = new Content({
  prompt: 'What is the capital of France?',
  response: 'The capital of France is Paris.',
});

const result = await scanner.syncScan({ profile_name: 'my-profile' }, content);

console.log(result.category); // "benign" | "malicious"
console.log(result.action); // "allow" | "block"

Management — Configuration CRUD (OAuth2)

import { ManagementClient } from '@cdot65/prisma-airs-sdk';

const client = new ManagementClient(); // reads PANW_MGMT_* env vars

// 8 sub-clients available:
client.profiles; // AI security profile CRUD
client.topics; // Custom detection topic CRUD
client.apiKeys; // API key lifecycle (create, list, regenerate, delete)
client.customerApps; // Customer application management
client.dlpProfiles; // DLP data profile listing
client.deploymentProfiles; // Deployment profile listing
client.scanLogs; // Scan activity log queries
client.oauth; // OAuth token management (get/invalidate)

Model Security — ML Model Scanning (OAuth2)

import { ModelSecurityClient } from '@cdot65/prisma-airs-sdk';

const client = new ModelSecurityClient(); // falls back to PANW_MGMT_* env vars

// 3 sub-clients: scans, securityGroups, securityRules
const scans = await client.scans.list({ limit: 10 });
const groups = await client.securityGroups.list();
const rules = await client.securityRules.list();

// PyPI integration auth
const pypiAuth = await client.getPyPIAuth();

AI Red Teaming — Automated Testing (OAuth2)

import { RedTeamClient } from '@cdot65/prisma-airs-sdk';

const client = new RedTeamClient(); // falls back to PANW_MGMT_* env vars

// 7 sub-clients: scans, reports, customAttackReports, targets, customAttacks, eula, instances
const scans = await client.scans.list({ limit: 5 });
const targets = await client.targets.list();
const categories = await client.scans.getCategories();

// EULA + instance management
const eulaStatus = await client.eula.getStatus();
const templates = await client.targets.getTargetTemplates();

// 7 convenience methods on the top-level client
const stats = await client.getScanStatistics();
const trend = await client.getScoreTrend('target-uuid');
const quota = await client.getQuota();
const errors = await client.getErrorLogs('job-uuid');
const dashboard = await client.getDashboardOverview();

Authentication

| Auth Method | Used By | | ------------------------------- | ----------------------------------------------------------- | | API Key (HMAC-SHA256) | AI Runtime Security scans only | | OAuth2 (client_credentials) | Everything else — Management CRUD, Red Team, Model Security |

# AI Runtime Security scans
export PANW_AI_SEC_API_KEY=your-api-key

# OAuth2 (shared by Management, Red Team, Model Security)
export PANW_MGMT_CLIENT_ID=your-client-id
export PANW_MGMT_CLIENT_SECRET=your-client-secret
export PANW_MGMT_TSG_ID=1234567890

Error Handling

import { AISecSDKException, ErrorType } from '@cdot65/prisma-airs-sdk';

try {
  await scanner.syncScan(profile, content);
} catch (err) {
  if (err instanceof AISecSDKException) {
    console.error(err.message);
    console.error(err.errorType);
  }
}

Error types: SERVER_SIDE_ERROR, CLIENT_SIDE_ERROR, USER_REQUEST_PAYLOAD_ERROR, MISSING_VARIABLE, AISEC_SDK_ERROR, OAUTH_ERROR.

Documentation

Full documentation at cdot65.github.io/prisma-airs-sdk — includes API reference, service guides, OAuth lifecycle docs, and examples.

Development

npm install
npm run build          # tsup (CJS + ESM + .d.ts)
npm run test           # vitest (970 tests, 99%+ coverage)
npm run lint           # eslint
npm run typecheck      # tsc --noEmit

License

MIT