@cdot65/prisma-airs-sdk 0.6.5 → 0.6.7

package/dist/index.d.cts

@@ -16503,6 +16503,7 @@ declare class Content {
     /**
      * Load content from a JSON file.
      * @param filePath - Path to JSON file containing scan request contents.
+     * @returns A new Content instance populated from the JSON file.
      */
     static fromJSONFile(filePath: string): Content;
 }
@@ -56696,8 +56697,8 @@ declare const MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 declare const MAX_CONNECTION_POOL_SIZE = 100;
 declare const MAX_NUMBER_OF_RETRIES = 5;
 declare const HTTP_FORCE_RETRY_STATUS_CODES: number[];
-declare const SDK_VERSION = "0.6.5";
-declare const USER_AGENT = "PAN-AIRS/0.6.5-typescript-sdk";
+declare const SDK_VERSION = "0.6.7";
+declare const USER_AGENT = "PAN-AIRS/0.6.7-typescript-sdk";
 declare const DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 declare const DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
 declare const MGMT_CLIENT_ID = "PANW_MGMT_CLIENT_ID";
@@ -56811,7 +56812,6 @@ declare class OAuthClient {
     getToken(): Promise<string>;
     /**
      * Clear the cached token, forcing a fresh fetch on next call.
-     * @returns Nothing.
      */
     clearToken(): void;
     /**
@@ -56931,7 +56931,7 @@ declare class TopicsClient {
     /**
      * Force-delete a custom topic, removing it from any referencing profiles.
      * @param topicId - UUID of the topic to force-delete.
-     * @param updatedBy - Email of the user performing the deletion.
+     * @param updatedBy - Optional. Email of the user performing the deletion.
      * @returns Deletion confirmation message.
      */
     forceDelete(topicId: string, updatedBy?: string): Promise<DeleteTopicResponse>;
@@ -57675,13 +57675,13 @@ declare class RedTeamReportsClient {
      * Download a report in the specified format.
      * @param jobId - The job UUID.
      * @param format - The file format (e.g. "pdf", "csv").
-     * @returns The downloaded report data.
+     * @returns The report data in the requested format (untyped — shape depends on `format`).
      */
     downloadReport(jobId: string, format: string): Promise<unknown>;
     /**
      * Generate a partial report for a running scan.
      * @param jobId - The job UUID.
-     * @returns The partial report data.
+     * @returns The partial report payload (untyped — schema not yet defined by the API).
      */
     generatePartialReport(jobId: string): Promise<unknown>;
 }
@@ -57907,7 +57907,7 @@ declare class RedTeamCustomAttacksClient {
     /**
      * Download CSV template for a prompt set.
      * @param uuid - The prompt set UUID.
-     * @returns The CSV template data.
+     * @returns The CSV template content (untyped — raw response from the API).
      */
     downloadTemplate(uuid: string): Promise<unknown>;
     /**

package/dist/index.d.ts

@@ -16503,6 +16503,7 @@ declare class Content {
     /**
      * Load content from a JSON file.
      * @param filePath - Path to JSON file containing scan request contents.
+     * @returns A new Content instance populated from the JSON file.
      */
     static fromJSONFile(filePath: string): Content;
 }
@@ -56696,8 +56697,8 @@ declare const MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 declare const MAX_CONNECTION_POOL_SIZE = 100;
 declare const MAX_NUMBER_OF_RETRIES = 5;
 declare const HTTP_FORCE_RETRY_STATUS_CODES: number[];
-declare const SDK_VERSION = "0.6.5";
-declare const USER_AGENT = "PAN-AIRS/0.6.5-typescript-sdk";
+declare const SDK_VERSION = "0.6.7";
+declare const USER_AGENT = "PAN-AIRS/0.6.7-typescript-sdk";
 declare const DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 declare const DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
 declare const MGMT_CLIENT_ID = "PANW_MGMT_CLIENT_ID";
@@ -56811,7 +56812,6 @@ declare class OAuthClient {
     getToken(): Promise<string>;
     /**
      * Clear the cached token, forcing a fresh fetch on next call.
-     * @returns Nothing.
      */
     clearToken(): void;
     /**
@@ -56931,7 +56931,7 @@ declare class TopicsClient {
     /**
      * Force-delete a custom topic, removing it from any referencing profiles.
      * @param topicId - UUID of the topic to force-delete.
-     * @param updatedBy - Email of the user performing the deletion.
+     * @param updatedBy - Optional. Email of the user performing the deletion.
      * @returns Deletion confirmation message.
      */
     forceDelete(topicId: string, updatedBy?: string): Promise<DeleteTopicResponse>;
@@ -57675,13 +57675,13 @@ declare class RedTeamReportsClient {
      * Download a report in the specified format.
      * @param jobId - The job UUID.
      * @param format - The file format (e.g. "pdf", "csv").
-     * @returns The downloaded report data.
+     * @returns The report data in the requested format (untyped — shape depends on `format`).
      */
     downloadReport(jobId: string, format: string): Promise<unknown>;
     /**
      * Generate a partial report for a running scan.
      * @param jobId - The job UUID.
-     * @returns The partial report data.
+     * @returns The partial report payload (untyped — schema not yet defined by the API).
      */
     generatePartialReport(jobId: string): Promise<unknown>;
 }
@@ -57907,7 +57907,7 @@ declare class RedTeamCustomAttacksClient {
     /**
      * Download CSV template for a prompt set.
      * @param uuid - The prompt set UUID.
-     * @returns The CSV template data.
+     * @returns The CSV template content (untyped — raw response from the API).
      */
     downloadTemplate(uuid: string): Promise<unknown>;
     /**

package/dist/index.js

@@ -29,7 +29,7 @@ var MAX_NUMBER_OF_BATCH_SCAN_OBJECTS = 5;
 var MAX_CONNECTION_POOL_SIZE = 100;
 var MAX_NUMBER_OF_RETRIES = 5;
 var HTTP_FORCE_RETRY_STATUS_CODES = [500, 502, 503, 504];
-var SDK_VERSION = "0.6.5";
+var SDK_VERSION = "0.6.7";
 var USER_AGENT = `PAN-AIRS/${SDK_VERSION}-typescript-sdk`;
 var DEFAULT_MGMT_ENDPOINT = "https://api.sase.paloaltonetworks.com/aisec";
 var DEFAULT_TOKEN_ENDPOINT = "https://auth.apps.paloaltonetworks.com/oauth2/access_token";
@@ -258,6 +258,11 @@ var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isValidUuid(value) {
   return UUID_RE.test(value);
 }
+function validateJobId(jobId) {
+  if (!isValidUuid(jobId)) {
+    throw new AISecSDKException(`Invalid job id: ${jobId}`, "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
+  }
+}
 function generatePayloadHash(payload, secret) {
   return createHmac("sha256", secret).update(payload).digest("hex");
 }
@@ -567,6 +572,7 @@ var Content = class _Content {
   /**
    * Load content from a JSON file.
    * @param filePath - Path to JSON file containing scan request contents.
+   * @returns A new Content instance populated from the JSON file.
    */
   static fromJSONFile(filePath) {
     const raw = readFileSync(filePath, "utf-8");
@@ -2753,7 +2759,6 @@ var OAuthClient = class {
   }
   /**
    * Clear the cached token, forcing a fresh fetch on next call.
-   * @returns Nothing.
    */
   clearToken() {
     this.accessToken = null;
@@ -2842,6 +2847,49 @@ var OAuthClient = class {
   }
 };
 
+// src/oauth-config.ts
+function resolveOAuthConfig(opts) {
+  const { primaryEnvPrefix, fallbackEnvPrefix } = opts;
+  const clientId = opts.clientId ?? process.env[`${primaryEnvPrefix}_CLIENT_ID`] ?? (fallbackEnvPrefix ? process.env[`${fallbackEnvPrefix}_CLIENT_ID`] : void 0);
+  const clientSecret = opts.clientSecret ?? process.env[`${primaryEnvPrefix}_CLIENT_SECRET`] ?? (fallbackEnvPrefix ? process.env[`${fallbackEnvPrefix}_CLIENT_SECRET`] : void 0);
+  const tsgId = opts.tsgId ?? process.env[`${primaryEnvPrefix}_TSG_ID`] ?? (fallbackEnvPrefix ? process.env[`${fallbackEnvPrefix}_TSG_ID`] : void 0);
+  const tokenEndpoint = opts.tokenEndpoint ?? process.env[`${primaryEnvPrefix}_TOKEN_ENDPOINT`] ?? (fallbackEnvPrefix ? process.env[`${fallbackEnvPrefix}_TOKEN_ENDPOINT`] : void 0);
+  const numRetries = Math.min(
+    Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
+    MAX_NUMBER_OF_RETRIES
+  );
+  const envHint = fallbackEnvPrefix ? `${primaryEnvPrefix}_CLIENT_ID / ${fallbackEnvPrefix}_CLIENT_ID` : `${primaryEnvPrefix}_CLIENT_ID`;
+  if (!clientId) {
+    throw new AISecSDKException(
+      `clientId is required (option or ${envHint} env var)`,
+      "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+    );
+  }
+  const secretHint = fallbackEnvPrefix ? `${primaryEnvPrefix}_CLIENT_SECRET / ${fallbackEnvPrefix}_CLIENT_SECRET` : `${primaryEnvPrefix}_CLIENT_SECRET`;
+  if (!clientSecret) {
+    throw new AISecSDKException(
+      `clientSecret is required (option or ${secretHint} env var)`,
+      "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+    );
+  }
+  const tsgHint = fallbackEnvPrefix ? `${primaryEnvPrefix}_TSG_ID / ${fallbackEnvPrefix}_TSG_ID` : `${primaryEnvPrefix}_TSG_ID`;
+  if (!tsgId) {
+    throw new AISecSDKException(
+      `tsgId is required (option or ${tsgHint} env var)`,
+      "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
+    );
+  }
+  const oauthClient = new OAuthClient({
+    clientId,
+    clientSecret,
+    tsgId,
+    tokenEndpoint,
+    tokenBufferMs: opts.tokenBufferMs,
+    onTokenRefresh: opts.onTokenRefresh
+  });
+  return { baseUrl: opts.baseUrl, oauthClient, numRetries, tsgId };
+}
+
 // src/management/management-http-client.ts
 async function managementHttpRequest(opts) {
   const { method, baseUrl, path, body, params, oauthClient, numRetries } = opts;
@@ -3100,7 +3148,7 @@ var TopicsClient = class {
   /**
    * Force-delete a custom topic, removing it from any referencing profiles.
    * @param topicId - UUID of the topic to force-delete.
-   * @param updatedBy - Email of the user performing the deletion.
+   * @param updatedBy - Optional. Email of the user performing the deletion.
    * @returns Deletion confirmation message.
    */
   async forceDelete(topicId, updatedBy) {
@@ -3447,80 +3495,57 @@ var ManagementClient = class {
   scanLogs;
   oauth;
   constructor(opts = {}) {
-    const clientId = opts.clientId ?? process.env[MGMT_CLIENT_ID];
-    const clientSecret = opts.clientSecret ?? process.env[MGMT_CLIENT_SECRET];
-    const tsgId = opts.tsgId ?? process.env[MGMT_TSG_ID];
     const apiEndpoint = opts.apiEndpoint ?? process.env[MGMT_ENDPOINT] ?? DEFAULT_MGMT_ENDPOINT;
-    const tokenEndpoint = opts.tokenEndpoint ?? process.env[MGMT_TOKEN_ENDPOINT];
-    const numRetries = Math.min(
-      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
-      MAX_NUMBER_OF_RETRIES
-    );
-    if (!clientId) {
-      throw new AISecSDKException(
-        "clientId is required (option or PANW_MGMT_CLIENT_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!clientSecret) {
-      throw new AISecSDKException(
-        "clientSecret is required (option or PANW_MGMT_CLIENT_SECRET env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!tsgId) {
-      throw new AISecSDKException(
-        "tsgId is required (option or PANW_MGMT_TSG_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    const oauthClient = new OAuthClient({
-      clientId,
-      clientSecret,
-      tsgId,
-      tokenEndpoint
+    const { baseUrl, oauthClient, numRetries, tsgId } = resolveOAuthConfig({
+      clientId: opts.clientId,
+      clientSecret: opts.clientSecret,
+      tsgId: opts.tsgId,
+      baseUrl: apiEndpoint,
+      numRetries: opts.numRetries,
+      tokenEndpoint: opts.tokenEndpoint,
+      primaryEnvPrefix: "PANW_MGMT"
     });
     this.profiles = new ProfilesClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       tsgId,
       numRetries
     });
     this.topics = new TopicsClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       tsgId,
       numRetries
     });
     this.apiKeys = new ApiKeysClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       tsgId,
       numRetries
     });
     this.customerApps = new CustomerAppsClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       tsgId,
       numRetries
     });
     this.dlpProfiles = new DlpProfilesClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       numRetries
     });
     this.deploymentProfiles = new DeploymentProfilesClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       numRetries
     });
     this.scanLogs = new ScanLogsClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       numRetries
     });
     this.oauth = new OAuthManagementClient({
-      baseUrl: apiEndpoint,
+      baseUrl,
       oauthClient,
       numRetries
     });
@@ -4136,55 +4161,34 @@ var ModelSecurityClient = class {
   oauthClient;
   numRetries;
   constructor(opts = {}) {
-    const clientId = opts.clientId ?? process.env[MODEL_SEC_CLIENT_ID] ?? process.env[MGMT_CLIENT_ID];
-    const clientSecret = opts.clientSecret ?? process.env[MODEL_SEC_CLIENT_SECRET] ?? process.env[MGMT_CLIENT_SECRET];
-    const tsgId = opts.tsgId ?? process.env[MODEL_SEC_TSG_ID] ?? process.env[MGMT_TSG_ID];
     const dataEndpoint = opts.dataEndpoint ?? process.env[MODEL_SEC_DATA_ENDPOINT] ?? DEFAULT_MODEL_SEC_DATA_ENDPOINT;
     const mgmtEndpoint = opts.mgmtEndpoint ?? process.env[MODEL_SEC_MGMT_ENDPOINT] ?? DEFAULT_MODEL_SEC_MGMT_ENDPOINT;
-    const tokenEndpoint = opts.tokenEndpoint ?? process.env[MODEL_SEC_TOKEN_ENDPOINT] ?? process.env[MGMT_TOKEN_ENDPOINT];
-    const numRetries = Math.min(
-      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
-      MAX_NUMBER_OF_RETRIES
-    );
-    if (!clientId) {
-      throw new AISecSDKException(
-        "clientId is required (option or PANW_MODEL_SEC_CLIENT_ID / PANW_MGMT_CLIENT_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!clientSecret) {
-      throw new AISecSDKException(
-        "clientSecret is required (option or PANW_MODEL_SEC_CLIENT_SECRET / PANW_MGMT_CLIENT_SECRET env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!tsgId) {
-      throw new AISecSDKException(
-        "tsgId is required (option or PANW_MODEL_SEC_TSG_ID / PANW_MGMT_TSG_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    this.oauthClient = new OAuthClient({
-      clientId,
-      clientSecret,
-      tsgId,
-      tokenEndpoint
+    const { oauthClient, numRetries } = resolveOAuthConfig({
+      clientId: opts.clientId,
+      clientSecret: opts.clientSecret,
+      tsgId: opts.tsgId,
+      baseUrl: mgmtEndpoint,
+      numRetries: opts.numRetries,
+      tokenEndpoint: opts.tokenEndpoint,
+      primaryEnvPrefix: "PANW_MODEL_SEC",
+      fallbackEnvPrefix: "PANW_MGMT"
     });
+    this.oauthClient = oauthClient;
     this.mgmtEndpoint = mgmtEndpoint;
     this.numRetries = numRetries;
     this.scans = new ModelSecurityScansClient({
       baseUrl: dataEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.securityGroups = new ModelSecurityGroupsClient({
       baseUrl: mgmtEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.securityRules = new ModelSecurityRulesClient({
       baseUrl: mgmtEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
   }
@@ -4312,11 +4316,6 @@ var RedTeamScansClient = class {
 };
 
 // src/red-team/reports-client.ts
-function validateJobId(jobId) {
-  if (!isValidUuid(jobId)) {
-    throw new AISecSDKException(`Invalid job id: ${jobId}`, "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
-  }
-}
 var RedTeamReportsClient = class {
   baseUrl;
   oauthClient;
@@ -4574,7 +4573,7 @@ var RedTeamReportsClient = class {
    * Download a report in the specified format.
    * @param jobId - The job UUID.
    * @param format - The file format (e.g. "pdf", "csv").
-   * @returns The downloaded report data.
+   * @returns The report data in the requested format (untyped — shape depends on `format`).
    */
   async downloadReport(jobId, format) {
     validateJobId(jobId);
@@ -4592,7 +4591,7 @@ var RedTeamReportsClient = class {
   /**
    * Generate a partial report for a running scan.
    * @param jobId - The job UUID.
-   * @returns The partial report data.
+   * @returns The partial report payload (untyped — schema not yet defined by the API).
    */
   async generatePartialReport(jobId) {
     validateJobId(jobId);
@@ -4608,11 +4607,6 @@ var RedTeamReportsClient = class {
 };
 
 // src/red-team/custom-attack-reports-client.ts
-function validateJobId2(jobId) {
-  if (!isValidUuid(jobId)) {
-    throw new AISecSDKException(`Invalid job id: ${jobId}`, "AISEC_USER_REQUEST_PAYLOAD_ERROR" /* USER_REQUEST_PAYLOAD_ERROR */);
-  }
-}
 var RedTeamCustomAttackReportsClient = class {
   baseUrl;
   oauthClient;
@@ -4628,7 +4622,7 @@ var RedTeamCustomAttackReportsClient = class {
    * @returns The custom attack report response.
    */
   async getReport(jobId) {
-    validateJobId2(jobId);
+    validateJobId(jobId);
     const res = await managementHttpRequest({
       method: "GET",
       baseUrl: this.baseUrl,
@@ -4644,7 +4638,7 @@ var RedTeamCustomAttackReportsClient = class {
    * @returns The prompt sets report response.
    */
   async getPromptSets(jobId) {
-    validateJobId2(jobId);
+    validateJobId(jobId);
     const res = await managementHttpRequest({
       method: "GET",
       baseUrl: this.baseUrl,
@@ -4662,7 +4656,7 @@ var RedTeamCustomAttackReportsClient = class {
    * @returns The list of prompt detail responses.
    */
   async getPromptsBySet(jobId, promptSetId, opts) {
-    validateJobId2(jobId);
+    validateJobId(jobId);
     if (!isValidUuid(promptSetId)) {
       throw new AISecSDKException(
         `Invalid prompt set id: ${promptSetId}`,
@@ -4688,7 +4682,7 @@ var RedTeamCustomAttackReportsClient = class {
    * @returns The prompt detail response.
    */
   async getPromptDetail(jobId, promptId) {
-    validateJobId2(jobId);
+    validateJobId(jobId);
     if (!isValidUuid(promptId)) {
       throw new AISecSDKException(
         `Invalid prompt id: ${promptId}`,
@@ -4711,7 +4705,7 @@ var RedTeamCustomAttackReportsClient = class {
    * @returns The paginated list of custom attacks.
    */
   async listCustomAttacks(jobId, opts) {
-    validateJobId2(jobId);
+    validateJobId(jobId);
     const params = buildRedTeamListParams(opts);
     if (opts?.threat !== void 0) params.threat = String(opts.threat);
     if (opts?.prompt_set_id !== void 0) params.prompt_set_id = opts.prompt_set_id;
@@ -4733,7 +4727,7 @@ var RedTeamCustomAttackReportsClient = class {
    * @returns The list of attack outputs.
    */
   async getAttackOutputs(jobId, attackId) {
-    validateJobId2(jobId);
+    validateJobId(jobId);
     if (!isValidUuid(attackId)) {
       throw new AISecSDKException(
         `Invalid attack id: ${attackId}`,
@@ -4755,7 +4749,7 @@ var RedTeamCustomAttackReportsClient = class {
    * @returns The list of property statistics.
    */
   async getPropertyStats(jobId) {
-    validateJobId2(jobId);
+    validateJobId(jobId);
     const res = await managementHttpRequest({
       method: "GET",
       baseUrl: this.baseUrl,
@@ -5102,7 +5096,7 @@ var RedTeamCustomAttacksClient = class {
   /**
    * Download CSV template for a prompt set.
    * @param uuid - The prompt set UUID.
-   * @returns The CSV template data.
+   * @returns The CSV template content (untyped — raw response from the API).
    */
   async downloadTemplate(uuid) {
     validateUuid(uuid, "prompt set uuid");
@@ -5346,61 +5340,45 @@ var RedTeamClient = class {
   oauthClient;
   numRetries;
   constructor(opts = {}) {
-    const clientId = opts.clientId ?? process.env[RED_TEAM_CLIENT_ID] ?? process.env[MGMT_CLIENT_ID];
-    const clientSecret = opts.clientSecret ?? process.env[RED_TEAM_CLIENT_SECRET] ?? process.env[MGMT_CLIENT_SECRET];
-    const tsgId = opts.tsgId ?? process.env[RED_TEAM_TSG_ID] ?? process.env[MGMT_TSG_ID];
     const dataEndpoint = opts.dataEndpoint ?? process.env[RED_TEAM_DATA_ENDPOINT] ?? DEFAULT_RED_TEAM_DATA_ENDPOINT;
     const mgmtEndpoint = opts.mgmtEndpoint ?? process.env[RED_TEAM_MGMT_ENDPOINT] ?? DEFAULT_RED_TEAM_MGMT_ENDPOINT;
-    const tokenEndpoint = opts.tokenEndpoint ?? process.env[RED_TEAM_TOKEN_ENDPOINT] ?? process.env[MGMT_TOKEN_ENDPOINT];
-    const numRetries = Math.min(
-      Math.max(opts.numRetries ?? MAX_NUMBER_OF_RETRIES, 0),
-      MAX_NUMBER_OF_RETRIES
-    );
-    if (!clientId) {
-      throw new AISecSDKException(
-        "clientId is required (option or PANW_RED_TEAM_CLIENT_ID / PANW_MGMT_CLIENT_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!clientSecret) {
-      throw new AISecSDKException(
-        "clientSecret is required (option or PANW_RED_TEAM_CLIENT_SECRET / PANW_MGMT_CLIENT_SECRET env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    if (!tsgId) {
-      throw new AISecSDKException(
-        "tsgId is required (option or PANW_RED_TEAM_TSG_ID / PANW_MGMT_TSG_ID env var)",
-        "AISEC_MISSING_VARIABLE" /* MISSING_VARIABLE */
-      );
-    }
-    this.oauthClient = new OAuthClient({ clientId, clientSecret, tsgId, tokenEndpoint });
+    const { oauthClient, numRetries } = resolveOAuthConfig({
+      clientId: opts.clientId,
+      clientSecret: opts.clientSecret,
+      tsgId: opts.tsgId,
+      baseUrl: dataEndpoint,
+      numRetries: opts.numRetries,
+      tokenEndpoint: opts.tokenEndpoint,
+      primaryEnvPrefix: "PANW_RED_TEAM",
+      fallbackEnvPrefix: "PANW_MGMT"
+    });
+    this.oauthClient = oauthClient;
     this.dataEndpoint = dataEndpoint;
     this.mgmtEndpoint = mgmtEndpoint;
     this.numRetries = numRetries;
     this.scans = new RedTeamScansClient({
       baseUrl: dataEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.reports = new RedTeamReportsClient({
       baseUrl: dataEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.customAttackReports = new RedTeamCustomAttackReportsClient({
       baseUrl: dataEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.targets = new RedTeamTargetsClient({
       baseUrl: mgmtEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
     this.customAttacks = new RedTeamCustomAttacksClient({
       baseUrl: mgmtEndpoint,
-      oauthClient: this.oauthClient,
+      oauthClient,
       numRetries
     });
   }